last executing test programs: 2.611707506s ago: executing program 3 (id=6848): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000b40), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_FRAME_RETRIES(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000380)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002cbd7000fddbdf250f0000000c000600010000000100000008000300", @ANYRES32=0x0, @ANYBLOB="0f7c70e569b30b639c89c51de1e4682234cd52d248"], 0x28}, 0x1, 0x0, 0x0, 0x4000001}, 0x8000) r4 = socket(0x10, 0x3, 0x0) r5 = socket(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r7) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r8, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x48, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x2, 0x8}}]}}]}, 0x48}}, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000026c0)=@newtfilter={0x70, 0x28, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0x10}, {0xe40ca4f7c51e5624}, {0xfff1, 0xb}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x38, 0x2, [@TCA_CGROUP_ACT={0x34, 0x1, [@m_skbmod={0x30, 0x16, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0x2, 0x2}}]}, 0x70}, 0x1, 0x0, 0x0, 0x4810}, 0x0) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000180), r11) sendmsg$NLBL_MGMT_C_ADD(r11, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000ec0)={0xf4, r12, 0xe701ac47a3d23ecd, 0x0, 0x0, {}, [@NLBL_MGMT_A_PROTOCOL={0x8}, @NLBL_MGMT_A_DOMAIN={0xce, 0x1, 'C\xec\xf8\xa0w\x15|\xd8\xbcs\xe1\xb93\x14\xcd\xcb\xb6\xb9\xbb\x84\xe5\xbc\xdb\x7f\x9a\xf2\xea\xcc\x91:v@\xe83-\x1d\xaagQl\x7f\tKt\fc\x1f\x17]\xd5\xd0\xf0\xa8\xeb\xd2g\x92\x04\x02\v\x00od\xe6,\xd3@I\x17\xf3\xbees0\xad\xc6\xbf/*\xb6(o\x91t\x12\x93U6\xf4@n\xdc\xdc\x8a7y\x81FY\xbe\xbbc\xd2\xc3\x01\xa5\xe2V\x8c\xb3im~\xd2V\xdaG\xbdbF\xc8n\x86\xac\x9c\xfb\xda\xe2&\"\xb4:\x13\xe9\tc\x85\xb4\xcb\x17\xbfm\x846\xe7\x7fp\x9eCdb\xad;\xa2\x8fs\xbf6\xe8\xe3Xg3&\xe2 \xd6\n\x9d=~<\x93/\xaf\x89\x06+\x96]\xb5+\xee\xff8^D*\xdb\xb8\xd8t\x80\xd4\x8fK=E0\xe8R\x83'}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, 0xf4}}, 0x0) sendmsg$NLBL_MGMT_C_ADDDEF(r10, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x64, r12, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x1}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x2}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @private2={0xfc, 0x2, '\x00', 0x1}}, @NLBL_MGMT_A_DOMAIN={0xd, 0x1, 'nl802154\x00'}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x3}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @private2}]}, 0x64}, 0x1, 0x0, 0x0, 0x20000000}, 0x4) sendmmsg$alg(r4, &(0x7f0000000140), 0x4924b68, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) getsockopt$IP_VS_SO_GET_VERSION(r1, 0x0, 0x480, &(0x7f0000000080), &(0x7f00000000c0)=0x40) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x1038, 0xffffffffffffffff, 0x0) 2.475793466s ago: executing program 3 (id=6851): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) (async) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) (async) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000340)=ANY=[@ANYBLOB="50000000010101020000000000000000020000000c00198008000200020c0008300002bb802c00018014000300fc02000000000000000000000007000114000400fc0100000000000000000000000000000afe671e2037e3ff3a566dabcd4be8c133d2da0034b50f0c5a2786f36ca9f5ed3c3c797626e7bc483249b800ba812d02215f8c003239666b08f966f419070100a9ffcc3956a2120c27cf2e094e5cc7c1c335282c8a3470b70c6a99ce62cf1a"], 0x50}}, 0x0) (async) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000340)=ANY=[@ANYBLOB="50000000010101020000000000000000020000000c00198008000200020c0008300002bb802c00018014000300fc02000000000000000000000007000114000400fc0100000000000000000000000000000afe671e2037e3ff3a566dabcd4be8c133d2da0034b50f0c5a2786f36ca9f5ed3c3c797626e7bc483249b800ba812d02215f8c003239666b08f966f419070100a9ffcc3956a2120c27cf2e094e5cc7c1c335282c8a3470b70c6a99ce62cf1a"], 0x50}}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) syz_genetlink_get_family_id$ipvs(0x0, r2) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, 0x0, 0x20000800) (async) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, 0x0, 0x20000800) r4 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r4, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r4, 0x29, 0x30, &(0x7f0000000740)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff"], 0x110) (async) setsockopt$inet6_MCAST_MSFILTER(r4, 0x29, 0x30, &(0x7f0000000740)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff"], 0x110) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff3, 0xc}, {0x0, 0x2}}}, 0x6c}, 0x1, 0x0, 0x0, 0x880}, 0x8010) sendmmsg$inet(r0, &(0x7f0000001240)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000140)="e22971ce9db45fb52ceafd0d7d8ae8251c3c56139fe91e5682ff6362aa78ea6863a4f066a199ecd88ac46a946aab8e368b42c040dbbea26adf", 0x39}, {&(0x7f0000000300)="b4b98f791417e9d68f2bfb2f299437050f4f43ac5a68311636bc061a6740c3c8dfb073d165ac78443e3882a721ec4cb748d16cf734", 0x35}], 0x2}}], 0x1, 0x2090) 2.296569894s ago: executing program 3 (id=6853): socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215ee000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r2 = socket(0x8, 0x3, 0x3) ioctl$sock_netrom_SIOCADDRT(r2, 0x61d8, 0x0) close(0x4) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000dc0), r3) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r3, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x40014) r4 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r4, 0x0, 0x0) read(r0, &(0x7f0000000240)=""/77, 0x4d) r5 = socket$packet(0x11, 0x2, 0x300) socketpair(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) bind$packet(r5, &(0x7f00000000c0)={0x11, 0x18, r7, 0x1, 0x81}, 0x14) setsockopt$packet_int(r5, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x6, 0xc, &(0x7f0000000300)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r8}, &(0x7f00000004c0), &(0x7f00000001c0)=r9}, 0x20) write$tun(r10, &(0x7f00000006c0)=ANY=[@ANYBLOB="03800002620008000000000006000000090000000000000000000000000000000100472400f1006500000e11907800000000ac1414bb01940400000100004e234e2400d5907804008000000200ec1c090000000000004af63fe1666b888180926ad55aa98321d6b9a8b137a59b88b7dc8c4c203e9db5b413e83f0f9bef927f67dd29220547febc2f0fab59d77e00612e3246eeddf452ebcb269026967de0ce3c67d2feebcb7ded627be884190a59b462dbb6ad5ca905b3cbffa82655ea59e47970eda2dbdd3c7890c7d86db5d540d71a3f4355ad04ad2a5ec0acadc0c62abd0ba35232222570622f9d0bceb73baabaab4363b2be64c5effa5670b16c7f0a4c596ebff902cd02790700b0f7cb0b0bc55b950074"], 0x113) setsockopt$packet_rx_ring(r5, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x0, 0x0, 0xffffffff}, 0x1c) r11 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r11, 0x0, 0x20000000) sendmsg$nl_route(r2, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f0000000800)=ANY=[@ANYBLOB="40000000130082d0000000000000000000000000d81957b6f5f52239cb82f29c72d9fde3f5b063bf76b3dbbf3fb40172538650b9ebf1", @ANYRES32=0x0, @ANYRES64=r1], 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x42) 1.661107126s ago: executing program 2 (id=6862): r0 = socket(0xa, 0x3, 0x3a) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r1, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000340)='./cgroup/cgroup.procs\x00', &(0x7f00000002c0)=[0x45c], 0x0, 0x0, 0x100000, 0x1}}, 0x40) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000001c0)={'tunl0\x00', &(0x7f0000000380)={'gretap0\x00', 0x0, 0x7, 0x48, 0x7, 0x0, {{0xa, 0x4, 0x1, 0x3, 0x28, 0x64, 0x0, 0x8, 0x29, 0x0, @dev={0xac, 0x14, 0x14, 0xc}, @private=0xa010101, {[@cipso={0x86, 0xa, 0x0, [{0x5, 0x4, "749d"}]}, @cipso={0x86, 0xa, 0x2, [{0x1, 0x4, "b3ce"}]}]}}}}}) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000040)={0x0, 0x1, 0x8, 0x0, 0x401}, 0xc) ioctl$SIOCGETMIFCNT_IN6(r0, 0x89e0, &(0x7f0000000180)) 1.42068191s ago: executing program 3 (id=6865): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x6, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)=@newtfilter={0x5c, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r3, {0x8, 0xa}, {}, {0xa}}, [@filter_kind_options=@f_flower={{0xb}, {0x2c, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS_MASK={0x10, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x2}]}]}, @TCA_FLOWER_KEY_ENC_OPTS={0x18, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x14, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x100c}]}]}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x22044028}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x71, 0x10, 0x79}, [@ldst={0x6}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd96, &(0x7f0000000080)=""/201, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffd56, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r4 = socket$netlink(0x10, 0x3, 0xb) ioctl$EXT4_IOC_SETFSUUID(r4, 0x4008662c, &(0x7f0000000180)={0x10, 0x0, "add61378e750568dfbdea67f43058f8c"}) 1.068974966s ago: executing program 1 (id=6867): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000440)={0x18, r1, 0x1, 0x3, 0x0, {}, [@NBD_ATTR_SOCKETS={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x20004000}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610424000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x1, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffd8b, 0xffffffffffffffff}, 0x48) 876.847695ms ago: executing program 3 (id=6868): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="100000002d000b02d25a806f8c6394f9101a04000a", 0xb}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8addf32ae0081044e81f78edb44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000594100000016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0, 0x0, 0x0, 0x5c8}, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="563f000019"], 0xfe33) 858.574324ms ago: executing program 4 (id=6869): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0xfc0, &(0x7f0000001c00)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xfb2, 0x2, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0xf9e, 0x0, @wg=@data={0x4, 0x7407, 0xfffffffffffffffd, "9c67524ed6ed152d4f775bbc411126513b67aa2818e6f3aeb55bee6ae1049f195705bc8bd9b1085cd41af77353267df8a1d4cecdb01908186ea04e641c89a2ee0432e9c0894a8d7aff0c865e96548d507f048f907320b0f8b1e83b5f1425b63ad9c6adfd09578bbda92c9bd8f57d6efd752a6f20487ebea241d612212e3ccb077a5150c08f56aed6ee45acd4439043886b78cc5562b00bc57cf509d90b02a7bc86919f1b882f556e6aac5e9b93ee545b2b68bd014e2a49c332432ef4adeb61ac418aa4e20ee299f1a8b7a72e985223996b11a8913f3b1c23b10f88c3de28660457a37126fd3b6394536da0cd962f532ff22c496e1df4ffe049b193514c02571399d3618383a287068f4f15d51d1781cc0bc2af66ddc68135bfd33634e1a75be80630ce76ef79c86c9abb2fdc6d84367ea10fd8a6ee3c99eaec83c66bf5ffce6eb5ccc2546b6df905ff1aea223029ba2f7eb2469c5b8637b79347361f8cf0fa9d58a039e7811f343961b22c23d68b2c04eb8b5aeee7c6f71ce95cab886bf2694e0643d18761043e2d1dcb8ce0bdd15817a75f591b05146424797f729689e2a7bd53cb6c02fd15c339057c714794b407b342d12e69ec383b6ea6c99f845d04fd5128203c78a388fb0a1caf1f725f7636eb41e415951f8284a9c475760eb9312f7d6307037d472fbda509d56a0cf8e36d44f3f0b67fabdd2842ab4241cbfc7d309188d3a634129a13bfcac3b39b75d46bed585550ff7b41746dfd7e0f0c8a25e9f39deb7e2a4f0e068b86c6593b3b37838d2809eef3eb2f3120fde2fe3e9fef4e4bea1ddf3d17c40f753b37baaa110a8b4ad805d500e0235e9371b828993da25c5697d1001c8971b3862eef047730b242350403c851cd74cdea94501c0e2875a5830aa71733a0f022cb37e1cfffaee8eb0a23d51181a0691dadcd6b30a86a5fbf5c499120e265938f6430ffde09eb173327c2e25bdf22ae0d742141db856c4beee07af0ce37c078f6e59b41a29502cc01737c984185f6622a3ce02ed04daf2a7eb03c92a5a5ecce5973ef704aba9efcb99bf52f5c662d52f4399a13af760f9f9ff3d5930c3fae014b92ee0aded4ba51d95cf946d5f55f5b5d4603f8b76087d681ad77fc385fe114331c24a4ada85eaebf5405467dbe656b31b79a0f893864a13bda309a2fec2f4fc4858d9daf946df31f4077338bfc3116a45827ce8907ad691d241d3a8859a3672aeee3878e45b0be6f68194638dee30ba6735a6424e51f8b9a4965d37ab7ca96e167a5c32c8a935ff34693e24d067039db0f4ffe4dc5fe7c56a0d6e52a7cef9a6f1cc8b88d61d2258e3e0e8f2d7b699d4a22ab661f6afae5b48cc8fbc9ddfe57e76f274e65b210994fd96cd4deb6fdb795df4147ca0d876b1b08b64d20a28a358f48086c0f8d1f0741260f95adabba51f2d3f36107d49d46ba0c666232597bf08bfab60b5a432a1652e2c503fcf977ea6ff15c8e8f3bd9b7a3017c36be787d5a6579f5236b17d7bdc2c3918d9257e266bdf7929bb366d98d2b225c08c3c5ed22113b8c051c811bd1e52ecbe619dbc9579270c7cf69ac129e84a7141e689d9745d56e1cda6affdc1856757a6e39039b17d5286cf393186b99b20c54987087ece9972c39b4a05f1ca218c35254c666e7fcb7df4aa401cc79e1aade63732064ca80af164709a85fcf8ac72fa5ace60aa04d2ee0d5f051cb032f7c25100facb7ec1c247812b0de4f1c3c1ab98f904d9752cc427bc0445d8e27b51d5a8084087ea61f82ccc1114679f673753eddc7cfc00ba7e25db3391579ecdf638ab73078133e49b522d3d16bf2ebd06e7cefc24154088965ad3c9291c68f19f7cdd2943abc716ecf0b33fe249108da2b1f9abdbcb4dba89746a8c5711a41556efe5537327e253bd9ac68dc56516392292152b86ef118e25cac4e3c7c2b20bbc5bbc2d825c8dc14e9807aa6a423fdebfa7deee913c8f9f58bd967d43af1d65dc5ce72b2cd1a17ce34facd199bf2c62beeb752d156d6f31ea0323bc3ec0500587c485d8141f5b5ac81457df9396fbf98222212ef70527b6ed8d6e4d11156c8ecaee4692e068a72cb3b12686436028a7297956c48ee8fc393907edd3695fddbb786808c0a48182e3334e73fedcef0ee1bfbb13dce8a79b8822fd1ca0ed645f64d134c240844be5a7ac3aa15419ae79e7b1d721ae5abe1b0896c6189f23b65d79f5c3677b89f40aceff98dfca244a160dff264a2b14a3774064e1152fe0cabfc23e3e16dba5f46ea6af09fb3b8529022837c7e9303e3ecd0170fcc0e6fb0f3981d9f8f838412eae1a3dd13b7a980a642739e8abebed29db34c06460f09e27ddba1ed76b4ac6290235f6f81fcd3eb12af9821575b050aaf80d5c6c695807f7480f24e4bc0159744f9045a2d37574508d7e687482f775d0a4c471c4914e6a64b0d444037407b8d079751ddf4b14ed0ee6f1e622952a331a1a147f3a805fb7ca29c3c7feb2dddd0db795ac0ca327d95b19ff37bd8d553703014e5137f8c41b947d199f95f245d3354f9679876db736da5cfbd7cb9f80a12e50c895b999b670c9e161aa12e82c79d98fed5017e11674158a2f258ecc7c550f10dee6bb9d159316c567e3973e8aa30f157f6d30f239877021e7161c0a93c7b6bedccc7a3d8c9313f6f860d33ae0c162236853ae29d7a619bc306998e51c5d91a73475119a648700fbf3a41701ef87b440b83573a44339aea5806c0883470613e38baa518466dee2c671d96768f8d842feb5a812ea3ecd1e307a913a1032f06af2656b0a969b38366c39ca149205540391f36c897efb80aa43707c12e21544386fc232a45c9eb40a64c35edd4db20bd4970d642c0c2a0ee43ce8bf4d1bd84b3c3fa198cfc8d1f83960a1c3cd85a164926dc962a9078c5b079e0f4bb0b4e94b0aec3d13e7c47edc936927da2e6e7fe9485b0489bc4fdd1699611aeb00d767057602b8e53dfb4a6651c0f2873e5f60fdd7e2542d6aba79f491f87522f77427323e87386c89e1df9dd6e4f32be85c9eefbd6e6b177dde573b0d0bb8df828185aedc7aba2e6c3d4d9df393b203c1147f005860a6dd44dbcebead0eeb29fe3216930ef4a5994a93851df960d3be82d4294b64ba8295a59d099fd10afe39c2a79727a5447fa27909d53df6a00a63897261619e853036a6852e95ac6da62276007f2f3f386267cd8a0d136e645247e76db84e466e56ba42618b4fdef3e6d8c48dae5d03e1e369cd74042146e361cd6b4e654c8adc75446c454d3275a7d91646c4fb721966df9df3f761f10bebd212bfc87db9c48ffa0c6efcb17db3955f4a6f58919a036cda4f0a0c07a7306d2909adeeb474bd0bbec58865c4a5804108a014838673ff26438c162ec61e71bb880b154d475c71d500bfda3128b9fac2bccecb790dbd3075f424b1244f111c7eb5cbb7af0b6f3ec9cac20f82b1631822b940c03d697e213747627a5a7ed57414f2826888e515b88e61e69b742b053fe086ffc916abe00a41870cd332201d96c96bd174b369094b0da81ddc50affefa3709a358a5c00308d30a41d10b1c3f91a011bd246588336ff76dd60c10c3bbc8eec06adb3e73cc21d218b83eb9306e0650dd4e41bd65e15bb99a0653fc312251c174abed9e3ed04ef0378feaf78d839ebf61fda85c290f140cd3690cff881c348c57f504c50ca61986b29e58fdb0cbe276e42c982154762110c0f65b240aebe4291c66157629f0a45ea48e8e6a5dfe062214d635c5f828d1c888ec83a279ddac80f748c00e984248bef8e884590dcc1322aceb2d3b525618450fa0649e4ae8722769c6a32eb47161f7bf08bd59f903240ab9f790313b41607554b21ce45f10cde937f9f68fbb23ace0eaebd86b1201ea230c7f4c57f6594e655904db2a6d3d294f98fe630a524573f52c145b19eea382bc3adac7c7b62863bfa04f2d9fb9b93e7cda0fff4af897281580b879912ebd2c9c9d433ef479e886a477ce4538590179049aaff5e8e51b25db6c0300393a37c25c350e1e4effdd657f26de15199d39e134d1e7fe278b68377674a0e31a12e67096d44f62bd0353147041050fe44d9fbfc95fa8aa368e5868148a9e7a6f5551cf55f677b48ac2b4cd29a300d3cb9cd3a5ef486b9b3138018fb1568ce3f59385b98e93b7113dc85cd242bb57e545d6c151727d1c33ced565b2e29419bc6c458b45ab2107a55793618d20bd476e81ff79543cbace7b26a53a67a3f17ad0e2f2c0cc55f45d374ddc3cf8ada0c52cf1251cc4a6e1c7e84a1536cf328a0a392a3b79bbef1b40ad6e69811f3ec73b971c7cf6d64bfd0b183135d76fbb121aa99c753dce310f3288d460a1158a0c1c2ca4a66eadb38c6669dae4742a1da14b007555ffdae4e60f535ee23018dde93863b028346edc0f8da3ee5208b06fb107e921492ed9f2f2064d865afb5f955c80b1a6c5dbc540f1af7dd68925353d288fce304243f09d1791661027ea11f21ade9abb81a71343f1d405f35b01a504a99e08514f3b8307dce0b7c4305c0e531a538c6c11d8021183a87c2de3e1e384d114559601b948359f153d9845067683d8ef3dc75829a46211368ddf4837c021bf3ba1cc8005ab6902e094635f86f2f090851d5ac0af51c3aec46bdf9024ebe196351e2acd483f71821f033aa02d7bdee2fe987412bda115a5ce7f51dfdb78ce378485801fa10180339d3c5372a65cc46d2f0ef8ad3317062af5c243f81d920075e4874ea69081ba22d8be502422e973128c657da28f4f63d34919b5a4663544e244524263bae0a9a6c7455a16b5b860aedea7a2ea87abb402e151461d8310d05dd611e063e278628420a3f7bf0fd9acfb6dc82741cb588b4d1d8a5b2b5db58e052b07c4e354034842102305c0b070dbe2cea7a59b306054ffcb08432c67d272f40d6d9f42826ed660e6558f80f8522499e0f89335c18297ee395bcbf0ad1af122434e9319177f9ad9c5c140841551733282f74ea025e4e3c4ae11dc64df48497d747ab0d08a2de58abff2242c6267a7498b7ae4fc1ebabc8dc5ede8a053000fe8af5ade0f6868c22d4b2602c36cfc3605a616850973edcc5ebec3e18dea4a4e3f4e11f1c979991b636233ae70f0cb42d592e5bc5b7b3773820b22c386f365738d4ba6a0e76e6e5ab480a77336b394fc807950df4939f6dda4cf088b318660da8b487b1cd0b8b8aaf69bc5c1f7330d1cfc7a7ab84f01a5f4d8ee0b887bd91d8af80be32e171ca03e9a906c6c8b342baec668db3ff9522002d5f60e751e712031d3cbeff0d47523625b3d41633e7c0d3ef3b5b4336b17c36075debcdea4b6357ab468114ae7265eaa39545973a602af35dfbd0ed03a3c6b717eefb92c52291a0b014ae4467a233db1d48c625228733262acf9d08c98e2aba18df6dde6160fe748bbaf217cae345449c1cb5e22ef26e6e8ef2666a307a3ca7a08ab2a7e3a938eab61b772a69aa4dce0ace312136870dadad35c98d2911b4d37dfcf31c3c36cd26177e3cda3049aecc9928545c2e102d2586225cfc96e9884042923e2874ebf71dc81060970705aba2a7ad1127b218e4ade098a41285ff7bee3a0b8dfcddf9933730183c92158d0bbc8dd874e3fab555c30075"}}}}}}, 0x0) readv(r2, &(0x7f0000000080)=[{&(0x7f0000002c40)=""/4096, 0xe56}], 0x1) ioctl$TUNGETSNDBUF(0xffffffffffffffff, 0x800454d3, &(0x7f0000001440)) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f0000000200)={'caif0\x00', 0x400}) ioctl$TUNGETIFF(r1, 0x800454d2, &(0x7f0000000b40)={'hsr0\x00'}) r3 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_FLUSH(r3, 0x0, 0x15, 0x0, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$team(&(0x7f0000000100), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000800)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_GET(r5, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000001480)=ANY=[@ANYBLOB="20000000e6992024b1ffba02e76d472cd1d9d25ca7a3f9cbfccb25dda18731529b98a3b8d24cce776b62977aa6336aedab2dd2cdfa64c72caf15539e46c15bc7fae86300de5f571460cbcb69972ad3e4449b", @ANYRES16=r6, @ANYBLOB="01002cbd7000fddbdf250200000008000100", @ANYRES32=r7, @ANYBLOB="04000280"], 0x20}, 0x1, 0x0, 0x0, 0x81}, 0x8000) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'veth0_vlan\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000001400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40080400}, 0xc, &(0x7f00000013c0)={&(0x7f00000012c0)={0xe4, r6, 0x400, 0x70bd2a, 0x25dfdbff, {}, [{{0x8, 0x1, r8}, {0x7c, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8, 0x6, r9}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}]}}, {{0x8, 0x1, r10}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x7}}, {0x8}}}]}}]}, 0xe4}, 0x1, 0x0, 0x0, 0x4000010}, 0x8840) recvmmsg(r0, &(0x7f0000002b80)=[{{0x0, 0x0, &(0x7f0000001280)=[{&(0x7f0000000200)=""/4096, 0xe9c}, {&(0x7f0000001200)=""/114, 0x72}], 0x2}, 0x562a}], 0x3ffffffffffff27, 0x0, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="180000002500010324bd5502ffdbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x4004088}, 0x0) 807.253848ms ago: executing program 0 (id=6870): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="b80000001900010026bd700000000000e00000020000000000000000000000000000000000000000100000000000000000000000ffff00000a"], 0xb8}}, 0x10) 741.502795ms ago: executing program 1 (id=6871): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000700)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000000e819f7588443b61c3ec1ccce6b523f88e2ab2914e0d895096c7107b6f45606da3459099c71f31241fe54e8376ead94dc5604bf0bd520a9e708657f9c012be8c0ee5295eb5400"/93], 0x0, 0x27, 0x0, 0x1}, 0x28) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="fcffffff000000002c0012800b0063f3ca696964676500001c0002800c00210009000000000000000c0022000200000000000000"], 0x4c}}, 0x0) 683.736885ms ago: executing program 1 (id=6872): r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000000)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) (async) r2 = socket$kcm(0x2, 0xa, 0x2) r3 = socket(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000005c0)={'vlan0\x00', 0x0}) bind$packet(r3, &(0x7f0000000180)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @remote}, 0x14) (async) sendmsg$ETHTOOL_MSG_EEE_SET(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x51}, 0x4) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000600), 0x3) (async) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f0000000ac0)=@gcm_128={{0x304}, "629f2ad1e25e04f2", "850100", "daf9af4a", "747aaaaf941f267e"}, 0x28) (async) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x4, &(0x7f0000000280)=@gcm_128={{0x304}, "41c000", "0cfcb67ecace717eb34a87013860510f", "15f4807f", "d4c27feb98ae71cc"}, 0x28) (async) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000007c0)=@security={'security\x00', 0x44, 0x4, 0x5d0, 0xffffffff, 0x0, 0x0, 0x3f8, 0xffffffff, 0xffffffff, 0x500, 0x500, 0x500, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x203, 0x200, 0x328, 0x8502, {}, [@common=@inet=@hashlimit3={{0x158}, {'ip6tnl0\x00', {0x7, 0x9, 0x42, 0x5, 0x7, 0xfd6, 0x5, 0x5, 0x18, 0x68}}}]}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'system_u:object_r:initctl_t:s0\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x11}}, @common=@unspec=@NFQUEUE2={0x28}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private2={0xfc, 0x2, '\x00', 0x1}, [0xff, 0xffffffff, 0xff000000, 0xff000000], 0x0, 0x4e21, 0x0, 0x4e23, 0x0, 0x8000}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x630) 645.774138ms ago: executing program 2 (id=6873): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'netdevsim0\x00', 0x0}) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="5c0100001000130700000000fcdbdf25e0000001000000000000000000000000ff020000000000000000210000000001000400004e2100020000000021000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="fc010000000000000000000000000000000004d632000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000090000000000000001000000ffffffff0000000000000000010000800000000043050000000000000400000000000000ffffffffffffff7f000000000000000001000000000000000000000000000000000000002cbd70000035000002000000500000000000000060001200726663343130362867636d2861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000060000000210466d38547aa140db9a200000000c538c7cb7a0c001c00", @ANYRES32=r2], 0x15c}, 0x1, 0x0, 0x0, 0x880}, 0x2014) 592.921748ms ago: executing program 0 (id=6874): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_int(r0, 0x6, 0x2, 0xfffffffffffffffd, &(0x7f0000000340)) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000a00)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000100)=@bridge_getneigh={0x20, 0x1e, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, 0x0, 0x0, 0x10004}}, 0x20}}, 0x0) 592.334336ms ago: executing program 3 (id=6875): socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215ee000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r2 = socket(0x8, 0x3, 0x3) ioctl$sock_netrom_SIOCADDRT(r2, 0x61d8, 0x0) close(0x4) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000dc0), r3) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r3, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x40014) r4 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r4, 0x0, 0x0) read(r0, &(0x7f0000000240)=""/77, 0x4d) r5 = socket$packet(0x11, 0x2, 0x300) socketpair(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) bind$packet(r5, &(0x7f00000000c0)={0x11, 0x18, r7, 0x1, 0x81}, 0x14) setsockopt$packet_int(r5, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x6, 0xc, &(0x7f0000000300)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r8}, &(0x7f00000004c0), &(0x7f00000001c0)=r9}, 0x20) write$tun(r10, &(0x7f00000006c0)=ANY=[@ANYBLOB="03800002620008000000000006000000090000000000000000000000000000000100472400f1006500000e11907800000000ac1414bb01940400000100004e234e2400d5907804008000000200ec1c090000000000004af63fe1666b888180926ad55aa98321d6b9a8b137a59b88b7dc8c4c203e9db5b413e83f0f9bef927f67dd29220547febc2f0fab59d77e00612e3246eeddf452ebcb269026967de0ce3c67d2feebcb7ded627be884190a59b462dbb6ad5ca905b3cbffa82655ea59e47970eda2dbdd3c7890c7d86db5d540d71a3f4355ad04ad2a5ec0acadc0c62abd0ba35232222570622f9d0bceb73baabaab4363b2be64c5effa5670b16c7f0a4c596ebff902cd02790700b0f7cb0b0bc55b950074"], 0x113) setsockopt$packet_rx_ring(r5, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x0, 0x0, 0xffffffff}, 0x1c) r11 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r11, 0x0, 0x20000000) sendmsg$nl_route(r2, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f0000000800)=ANY=[@ANYBLOB="40000000130082d0000000000000000000000000d81957b6f5f52239cb82f29c72d9fde3f5b063bf76b3dbbf3fb40172538650b9ebf1", @ANYRES32=0x0, @ANYRES64=r1], 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x42) 557.54818ms ago: executing program 1 (id=6876): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x200280d0}, 0x40) syz_emit_ethernet(0x46, &(0x7f0000000100)=ANY=[@ANYBLOB="0180c20000028f4961884fc486dd6000000000103afffe8000010000000000fe800001000000ff0200000000000000000000000000018c00"], 0x0) 502.958481ms ago: executing program 0 (id=6877): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newlink={0x38, 0x10, 0x439, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_FLAGS={0x6, 0xf, 0xd}]}}}]}, 0x38}}, 0x0) r1 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001700)=@bridge_getvlan={0x20, 0x72, 0x333, 0x6, 0x4, {}, [@BRIDGE_VLANDB_DUMP_FLAGS={0x8, 0x1, 0x7ffffffe}]}, 0x20}}, 0x20000050) sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x44001}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_TARGET={0x8}]}}]}, 0x3c}}, 0x0) r4 = socket(0x10, 0x803, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000a80), r5) sendmsg$DEVLINK_CMD_PORT_SET(r5, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000b80)={&(0x7f0000000ac0)={0x44, r6, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x6, 0x4, 0x3}}]}, 0x44}, 0x1, 0x0, 0x0, 0xc850}, 0x440c0) sendmsg$nl_route(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="3800000056000100000000f70000000007020000", @ANYRES32, @ANYBLOB="200001"], 0x38}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x2c, r8, 0x5, 0x70bd27, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x8, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_PLCPFAIL={0x4}]}]]}, 0x2c}, 0x1, 0x0, 0x0, 0x40080}, 0x0) sendmsg$NL80211_CMD_ASSOCIATE(r3, &(0x7f0000000400)={&(0x7f0000000280), 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x58, r8, 0x8, 0x70bd29, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x8001, 0x7f}}}}, [@NL80211_ATTR_FILS_NONCES={0x24, 0xf3, [0x7fff, 0x2, 0x2312, 0xfffa, 0xfff, 0x9, 0x800, 0x3, 0x1, 0x7f, 0x7f, 0x8, 0x3, 0x8000, 0x9, 0x3]}, @NL80211_ATTR_DISABLE_HT={0x4}, @NL80211_ATTR_DISABLE_HT={0x4}, @NL80211_ATTR_PREV_BSSID={0xa, 0x4f, @random="f7cc13ad7b63"}]}, 0x58}, 0x1, 0x0, 0x0, 0x4040045}, 0x4) r10 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) connect$unix(r10, &(0x7f0000000100)=@abs={0x27}, 0x6e) r11 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r11, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x50, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r2, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x24, 0x2, [@TCA_HHF_ADMIT_BYTES={0x8, 0x5, 0x4}, @TCA_HHF_RESET_TIMEOUT={0x8, 0x4, 0xffff85fd}, @TCA_HHF_ADMIT_BYTES={0x8, 0x5, 0x9}, @TCA_HHF_QUANTUM={0x8, 0x2, 0x8}]}}]}, 0x50}}, 0x0) 409.593171ms ago: executing program 4 (id=6878): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001c40)=@newtaction={0xf0, 0x30, 0x1, 0x0, 0x25dfdbfc, {}, [{0xdc, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x0, 0x2, 0x0, 0x0, {}, {}, 0x0, 0x0, 0xfffffffd}}]]}, {0x4}, {0xc}, {0xc}}}, @m_police={0x6c, 0x2, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x1, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x2000000}}]]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xf0}}, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0x0) 409.33044ms ago: executing program 2 (id=6879): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x28, 0x21, 0x10, 0x30bd29, 0x0, {0x4}, [@typed={0xc, 0x1d, 0x0, 0x0, @u64=0xd}, @typed={0x8, 0x17, 0x0, 0x0, @u32=0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x42804}, 0x4000000) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r0) 407.061321ms ago: executing program 1 (id=6880): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000600), 0x4) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x7) syz_emit_ethernet(0x8e, &(0x7f0000000240)={@broadcast, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "d20040", 0x58, 0x3a, 0x0, @dev, @local, {[], @param_prob={0x4, 0x0, 0x0, 0x0, {0x0, 0x6, "31c909", 0x0, 0x2b, 0x0, @empty, @remote, [@srh={0x6c, 0x4, 0x4, 0x2, 0x0, 0x0, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @remote]}]}}}}}}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, {0x0, 0x8}, {0xfff1, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000980)=@delchain={0x24, 0x64, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xfff3, 0xfff1}, {0x0, 0x1b}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021501700001e0a05010000000000000000070000000900020073797a31000000000900010073797a300000000024170380300000802c000180250001007bb0c03ce8ed22d039cce454fd98ae614b08a9f3d4ddf1f742d55995afac076948000000f01600800c00054000000000000000000c00054000000000000000000c00044000000000000000000c00044000000000000000000600064019d20000ac0201802800028008000340000000000900020073797a3100000000080003400000000008000180000000003800028008000340000000000800018000000000080003400000000008000340000000000900020073797a300000000008000340000000002c00028008000340000000000900020073797a31000000000900020073797a32000000000800034000000000d0000100b408b1e286b5c8f7a7321d1f80c982b3c96b4dac7dead86aceee30544dfdb289f2cae899fc3fe86ee3f122505d76d6b5878270ecb40c37908d60b9ed31d97a3e0ee856f3cf3c2fdfee967991f8d1ef7fdce37b30f8842735e543ac808675a64f66eb37009373328ddf992e92b3a5765bd5f765d73c578babbb08efd7b59dab641a88f3099e34bb7fbc04cb298bb0df6eb0dc4ca79864758aff38b7192698c89435c5699f4a9222ad4a2c68c9356b741f04ef667f7a169b8976632c7cb98f18ba558bc302c7b73401c42a76160c0002800800034000000000440002800900020073797a310000000008000340000000000900020073797a32000000000900020073797a320000000008000180000000000900020073797a3200000000fc0001"], 0x17d4}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r6, 0xc004743e, &(0x7f0000000140)) ioctl$PPPIOCSPASS(r6, 0x40107447, &(0x7f0000000180)={0x1, &(0x7f0000000000)=[{0x6}]}) ioctl$PPPIOCSPASS(r6, 0x40107447, &(0x7f0000000240)={0x0, 0x0}) sendmsg$nl_generic(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="4801000042000100fffffffffddbdf250200000004003880100001800c00c8000200000000000000200104801c01"], 0x148}, 0x1, 0x0, 0x0, 0x8800}, 0x4040) 353.665467ms ago: executing program 4 (id=6881): r0 = socket$can_j1939(0x1d, 0x2, 0x7) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)={0x50, 0x2, 0x6, 0x401, 0xe4340000, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e21}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_DATA={0x4}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}]}, 0x50}}, 0x8000) bind(r0, &(0x7f0000000300)=@generic={0x1d, "89d079df2815ae43ccda410d348bbaf2c702c43620d58cdcb15013f741d03baaac7b8af347ca8ca97c8c3809f4ce980c1cc8c67d21e7f9df75174022adfe4be24c8bdd3404567381bdb993980ee0e2e9c718953d01b39522000cc983dffd0c0b4dd1d9a48151cb47dfb833b15605350d8a722fa9893e21643cd43ffd3fd8"}, 0x80) 341.894689ms ago: executing program 2 (id=6882): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="760a00000000000061109800000000001800000000000000020000000000000095"], &(0x7f0000000000)='GPL\x00'}, 0x90) 239.53316ms ago: executing program 4 (id=6883): syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x1c, 0x7, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x1c}}, 0x0) recvmmsg(r1, &(0x7f0000004040)=[{{0x0, 0x0, &(0x7f0000002780)}, 0x1}], 0x1, 0x20, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYRESHEX=r2], 0x2c}, 0x1, 0x0, 0x0, 0x200041c1}, 0x4004850) 238.956769ms ago: executing program 0 (id=6884): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000240)=@newlink={0x40, 0x10, 0xc3b, 0x0, 0x25dfdbfd, {}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_OKEY={0x8, 0x5, 0x6}]}}}]}, 0x40}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'syztnl2\x00', &(0x7f00000000c0)={'ip6_vti0\x00', 0x0, 0x29, 0x5, 0x8, 0x5, 0x10, @mcast2, @empty, 0x10, 0x10, 0x7, 0x9}}) r2 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x50, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r3, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x24, 0x2, [@TCA_HHF_ADMIT_BYTES={0x8, 0x5, 0x4}, @TCA_HHF_RESET_TIMEOUT={0x8, 0x4, 0xffff85fd}, @TCA_HHF_ADMIT_BYTES={0x8, 0x5, 0x9}, @TCA_HHF_QUANTUM={0x8, 0x2, 0x8}]}}]}, 0x50}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@ipv6_getnetconf={0x54, 0x52, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@NETCONFA_RP_FILTER={0x8, 0x3, 0x4}, @NETCONFA_PROXY_NEIGH={0x8, 0x5, 0x1}, @NETCONFA_IFINDEX={0x8, 0x1, r1}, @NETCONFA_FORWARDING={0x8, 0x2, 0xf}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x5}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x5}, @NETCONFA_PROXY_NEIGH={0x8, 0x5, 0xf27}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8001}]}, 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x8000) 194.920177ms ago: executing program 0 (id=6885): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r1) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000140)={'wlan0\x00'}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={0x14, 0x0, 0x8, 0x101, 0x0, 0x0, {0x0, 0x0, 0x7}}, 0x14}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[], 0x3c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) r5 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x3fe3aa0262d8c583, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xfff3}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_ECN_PROB={0x8, 0x9, 0x2a}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2}, 0x2000400c) sendmsg$nl_route(r0, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f00000002c0)=ANY=[@ANYBLOB="2c0000001dffffffffffffff00ffffffffbe39c964e70901759e87606f6bc49a8a416645b86a30f1dd0acfde5942cacbefec3b589ef4bc35246503893a07373ffb5a40f01af1611662ab637af787fc34480de5b41825aba47dfe01cc5fbfc9a64d91c1e0071fb1b267a9b3d0", @ANYRES32=r2, @ANYBLOB="12030000000000000a000100aaaaaaaaaabb0000"], 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x42) socket$nl_route(0x10, 0x3, 0x0) (async) socket(0x10, 0x803, 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r1) (async) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000140)={'wlan0\x00'}) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={0x14, 0x0, 0x8, 0x101, 0x0, 0x0, {0x0, 0x0, 0x7}}, 0x14}}, 0x0) (async) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[], 0x3c}}, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) (async) socket(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00'}) (async) sendmsg$nl_route_sched(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x3fe3aa0262d8c583, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xfff3}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_ECN_PROB={0x8, 0x9, 0x2a}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2}, 0x2000400c) (async) sendmsg$nl_route(r0, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f00000002c0)=ANY=[@ANYBLOB="2c0000001dffffffffffffff00ffffffffbe39c964e70901759e87606f6bc49a8a416645b86a30f1dd0acfde5942cacbefec3b589ef4bc35246503893a07373ffb5a40f01af1611662ab637af787fc34480de5b41825aba47dfe01cc5fbfc9a64d91c1e0071fb1b267a9b3d0", @ANYRES32=r2, @ANYBLOB="12030000000000000a000100aaaaaaaaaabb0000"], 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x42) (async) 184.408163ms ago: executing program 2 (id=6886): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c0000005e00250a00040000fedbdf25020004000000000004000b0060cdee77fd4ad6c42697a090bb6c6b5ccd0a5c3d970287d485b3bce67c34edc605c5e630d6e43496b337a79f967af80e29d9dd8ae142819389b128eda93d8657521f175af631d82d0bf76012cb7eb4318c6b9c879c8c8ea2a565ca1973907cf61d98a513e2556ff8b7d3e41ed400"/153], 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newtaction={0x64, 0x30, 0xeaa3ef926154ef0f, 0x0, 0x0, {}, [{0x50, 0x1, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x8001, 0x2, 0x8, 0x7, 0x10001}, 0x1}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0x64}}, 0x0) 125.591036ms ago: executing program 4 (id=6887): syz_emit_ethernet(0x34, &(0x7f00000000c0)={@multicast, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x26, 0x0, 0x0, 0x0, 0x2f, 0x0, @rand_addr, @empty}, {0x0, 0x88be, 0x12, 0x0, @opaque="6b8b836832cfd4d288a8"}}}}}, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) write$tun(r0, &(0x7f0000000100)={@void, @void, @ipv4=@igmp={{0x8, 0x4, 0x0, 0x10, 0x39, 0x68, 0x0, 0x10, 0x2, 0x0, @remote, @remote, {[@end, @noop, @generic={0x0, 0x8, "ac252eb50a81"}, @end]}}, {0x8, 0x7f, 0x0, @rand_addr=0x64010101, "85d9bd0be2fa52f666fb37f3104018b37d"}}}, 0x39) 91.254379ms ago: executing program 4 (id=6888): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f00000000c0)=@gcm_256={{0x303}, '\x00', "6093bb6766b859309741b314c420483a65c907f500000000000000000100", "00ea3c2a", "120200000004fb2f"}, 0x38) setsockopt$inet6_tcp_int(r2, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x8000, @loopback, 0xffff}, 0x1c) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @multicast}) ioctl$OCFS2_IOC_REFLINK(r1, 0x40186f04, &(0x7f0000000140)={&(0x7f0000000000)='\xbb\xbb\xbb\xbb\xbb\xbb', &(0x7f0000000100)='syzkaller1\x00', 0x96}) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="00000806"], 0xfdef) 81.140271ms ago: executing program 0 (id=6889): ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000100)={'ip6_vti0\x00', &(0x7f0000000080)={'ip6gre0\x00', 0x0, 0x29, 0x8, 0x6, 0x2, 0x6, @private1={0xfc, 0x1, '\x00', 0x1}, @private0={0xfc, 0x0, '\x00', 0x1}, 0x8000, 0x7800, 0x7, 0x5}}) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r0) sendmsg$NL80211_CMD_SET_TID_CONFIG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000800)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="8b300000000000000000150000000c00990004000008000d801400030089183c5eef5f7ececb2b566a1762b53b9d46d307547ab11952dde2a7b2d27b18096d7fc548c121629165813463d2eeb32f7f72ede1332db6c590db017bf47688d079c74e7d46897e54c2cc48121457fcc138a34359b38c4727fee1786b7fdc0d7e3f8b699189bc8d4159b3fcab8e264ec74fdfd355ebb0628f0966cb3b7fa6e312bf9834a7ca7c2e6667a3e4c81aeef8c0cd3994c3c6069d0d1fdcbf30f412124d1d13f748415b659d2bf1c340847f427c29e8bd5f2e1e15492ee5304e024d49f35b943f41fe6b1f3fcfd0a37596bc04773bcb7e3c1a8438041243d0afc39a9609686f0770901622d43ce58fa12ac15b6dd80906cfd375406d0c92b302666ef5e8"], 0x30}}, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000140)='pim6reg\x00', 0x10) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x3) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r3) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket(0x2000000000000021, 0x2, 0x10000000000002) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r5) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYRES64=r1], 0x7c}, 0x1, 0x0, 0x0, 0xc090}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x20040055}, 0x40) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c00018006000100d1de0000080003400000000114000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001cc0)=ANY=[@ANYRES64=0x0], 0xdc}}, 0x0) sendmsg$NFT_MSG_GETRULE(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000190a0102"], 0x14}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a300000e0ff0900030073797a32000000002c000000060a010400000000100000000100000008000b40000000000900010073797a30000000000400074014000000110001"], 0xa0}, 0x1, 0x0, 0x0, 0x2004c899}, 0x0) recvmmsg(r6, &(0x7f000000c2c0)=[{{0x0, 0x0, 0x0}, 0xfffffff7}], 0x1, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="400000000d0a01f9ffffff00000000000a0000010900020073797a31000000000900010073797a31"], 0x40}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) socket$nl_route(0x10, 0x3, 0x0) 1.583962ms ago: executing program 1 (id=6890): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x20004001}, 0x4000018) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310007000008000a40fffffffc14000000110001"], 0x64}, 0x1, 0x0, 0x0, 0x94}, 0x24000000) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a3c000000090a010e00000000000000000a0000040900020073797a310000000008000a40fffffffc0900010073797a3100000000080005400000000d14000000110001000000000000000000708ae322518544a40100000a"], 0x64}, 0x1, 0x0, 0x0, 0x4044050}, 0x4000000) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x2c, r2, 0x5, 0x70bd27, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40080}, 0x0) 0s ago: executing program 2 (id=6891): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000780)=ANY=[@ANYBLOB="9feb01001800000000000000280000002800000002000000000000000000000105000000000000000000000001000085000000000000000001"], 0x0, 0x42}, 0x28) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000180)=ANY=[@ANYBLOB="24000000210001000000000000000008000b00ff0f00"/36], 0x24}, 0x1, 0x0, 0x0, 0x801}, 0x40) kernel console output (not intermixed with test programs): allmulticast mode [ 478.720346][T22834] netlink: 'syz.3.5308': attribute type 10 has an invalid length. [ 478.754778][T22834] team0: Port device dummy0 added [ 478.759162][T22843] netlink: 'syz.1.5314': attribute type 9 has an invalid length. [ 479.106114][ T9793] IPVS: starting estimator thread 0... [ 479.115963][T22867] openvswitch: netlink: Message has 6 unknown bytes. [ 479.224524][T22868] IPVS: using max 29 ests per chain, 69600 per kthread [ 479.309937][T22878] syzkaller1: entered promiscuous mode [ 479.316481][T22878] syzkaller1: entered allmulticast mode [ 479.769132][T22916] pim6reg1: entered promiscuous mode [ 479.777524][T22916] pim6reg1: entered allmulticast mode [ 479.878764][T22926] --map-set only usable from mangle table [ 480.259860][T22952] netlink: 'syz.2.5353': attribute type 21 has an invalid length. [ 480.273417][T22954] ip6t_srh: unknown srh match flags 4000 [ 480.306086][T22956] syzkaller0: entered promiscuous mode [ 480.318606][T22956] syzkaller0: entered allmulticast mode [ 480.404935][T22961] vlan1: entered allmulticast mode [ 480.410089][T22961] bridge9: entered allmulticast mode [ 480.417699][T22961] erspan0: left promiscuous mode [ 480.426100][T22961] bridge7: port 1(erspan0) entered disabled state [ 480.449973][T22961] bridge9: port 1(erspan0) entered blocking state [ 480.456922][T22961] bridge9: port 1(erspan0) entered disabled state [ 480.466095][T22961] erspan0: entered promiscuous mode [ 480.616043][T22970] FAULT_INJECTION: forcing a failure. [ 480.616043][T22970] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 480.636982][T22967] netlink: 'syz.4.5361': attribute type 3 has an invalid length. [ 480.645499][T22970] CPU: 1 UID: 0 PID: 22970 Comm: syz.2.5359 Not tainted syzkaller #0 PREEMPT(full) [ 480.645525][T22970] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 480.645536][T22970] Call Trace: [ 480.645544][T22970] [ 480.645552][T22970] dump_stack_lvl+0xe8/0x150 [ 480.645581][T22970] should_fail_ex+0x412/0x560 [ 480.645613][T22970] _copy_from_user+0x2d/0xb0 [ 480.645635][T22970] ___sys_sendmsg+0x1c6/0x360 [ 480.645662][T22970] ? __pfx____sys_sendmsg+0x10/0x10 [ 480.645722][T22970] ? __fget_files+0x2a/0x420 [ 480.645748][T22970] ? __fget_files+0x3a0/0x420 [ 480.645781][T22970] __x64_sys_sendmsg+0x1bd/0x2a0 [ 480.645805][T22970] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 480.645833][T22970] ? __pfx_ksys_write+0x10/0x10 [ 480.645861][T22970] do_syscall_64+0x14d/0xf80 [ 480.645882][T22970] ? trace_irq_disable+0x3b/0x150 [ 480.645898][T22970] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 480.645917][T22970] ? clear_bhb_loop+0x40/0x90 [ 480.645938][T22970] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 480.645955][T22970] RIP: 0033:0x7f98ae59c819 [ 480.645973][T22970] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 480.645988][T22970] RSP: 002b:00007f98af53a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 480.646008][T22970] RAX: ffffffffffffffda RBX: 00007f98ae815fa0 RCX: 00007f98ae59c819 [ 480.646022][T22970] RDX: 0000000000044004 RSI: 00002000000000c0 RDI: 0000000000000004 [ 480.646034][T22970] RBP: 00007f98af53a090 R08: 0000000000000000 R09: 0000000000000000 [ 480.646046][T22970] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 480.646057][T22970] R13: 00007f98ae816038 R14: 00007f98ae815fa0 R15: 00007fff82d8d908 [ 480.646085][T22970] [ 481.076795][T22987] 8021q: adding VLAN 0 to HW filter on device bond0 [ 481.109096][T22987] bond0: (slave rose0): Enslaving as an active interface with an up link [ 481.316322][T22997] vlan0: entered allmulticast mode [ 481.322255][T22997] bridge8: entered allmulticast mode [ 481.369604][T23009] erspan0: left promiscuous mode [ 481.411318][T23009] bridge3: port 1(erspan0) entered disabled state [ 481.467865][T23009] bridge8: port 1(erspan0) entered blocking state [ 481.476620][T23015] __nla_validate_parse: 18 callbacks suppressed [ 481.476639][T23015] netlink: 152 bytes leftover after parsing attributes in process `syz.0.5372'. [ 481.484271][T23009] bridge8: port 1(erspan0) entered disabled state [ 481.505828][T23020] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5373'. [ 481.507654][T23009] erspan0: entered promiscuous mode [ 481.525924][T23009] bridge8: port 1(erspan0) entered blocking state [ 481.532568][T23009] bridge8: port 1(erspan0) entered forwarding state [ 481.545787][T23021] sctp: [Deprecated]: syz.1.5371 (pid 23021) Use of struct sctp_assoc_value in delayed_ack socket option. [ 481.545787][T23021] Use struct sctp_sack_info instead [ 481.698933][T23018] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 481.735865][T23035] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5376'. [ 481.755723][T23018] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 481.883502][T23037] syzkaller0: entered promiscuous mode [ 481.889077][T23037] syzkaller0: entered allmulticast mode [ 481.928806][T23042] sock: sock_set_timeout: `syz.3.5377' (pid 23042) tries to set negative timeout [ 481.962723][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 481.970785][ C0] lec:lec_tx_timeout: lec0 [ 481.976099][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 482.016777][T23018] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 482.048090][T23018] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 482.314655][T23065] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5383'. [ 482.441895][T23069] netlink: 'syz.4.5385': attribute type 13 has an invalid length. [ 483.551082][T23018] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 483.561476][T23018] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 483.581152][T23069] macvtap0: entered allmulticast mode [ 483.593816][T23069] macvtap0: refused to change device tx_queue_len [ 483.714007][T23018] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 483.718234][T23075] Cannot find del_set index 3 as target [ 483.746133][T23018] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 483.784092][T23082] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5389'. [ 483.951953][T23098] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5393'. [ 483.965492][T23098] FAULT_INJECTION: forcing a failure. [ 483.965492][T23098] name failslab, interval 1, probability 0, space 0, times 0 [ 483.980659][T23098] CPU: 0 UID: 0 PID: 23098 Comm: syz.0.5393 Not tainted syzkaller #0 PREEMPT(full) [ 483.980685][T23098] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 483.980697][T23098] Call Trace: [ 483.980705][T23098] [ 483.980713][T23098] dump_stack_lvl+0xe8/0x150 [ 483.980744][T23098] should_fail_ex+0x412/0x560 [ 483.980776][T23098] should_failslab+0xa8/0x100 [ 483.980801][T23098] __kmalloc_cache_noprof+0x88/0x660 [ 483.980824][T23098] ? netlbl_unlhsh_add+0x25f/0x1290 [ 483.980853][T23098] netlbl_unlhsh_add+0x25f/0x1290 [ 483.980882][T23098] ? netlbl_unlhsh_add+0xe5/0x1290 [ 483.980907][T23098] ? __pfx_netlbl_unlhsh_add+0x10/0x10 [ 483.980932][T23098] ? apparmor_secctx_to_secid+0x98/0x110 [ 483.980966][T23098] netlbl_unlabel_staticadddef+0x535/0x690 [ 483.980993][T23098] ? __pfx_netlbl_unlabel_staticadddef+0x10/0x10 [ 483.981025][T23098] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 483.981057][T23098] genl_family_rcv_msg_doit+0x22a/0x330 [ 483.981085][T23098] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 483.981121][T23098] ? bpf_lsm_capable+0x9/0x20 [ 483.981146][T23098] ? security_capable+0x7e/0x2c0 [ 483.981188][T23098] genl_rcv_msg+0x61c/0x7a0 [ 483.981218][T23098] ? __pfx_genl_rcv_msg+0x10/0x10 [ 483.981238][T23098] ? __pfx_netlbl_unlabel_staticadddef+0x10/0x10 [ 483.981264][T23098] ? __lock_acquire+0x6b5/0x2cf0 [ 483.981299][T23098] netlink_rcv_skb+0x232/0x4b0 [ 483.981328][T23098] ? __pfx_genl_rcv_msg+0x10/0x10 [ 483.981351][T23098] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 483.981397][T23098] ? down_read+0x272/0x2e0 [ 483.981418][T23098] ? genl_rcv+0xd/0x40 [ 483.981441][T23098] genl_rcv+0x28/0x40 [ 483.981460][T23098] netlink_unicast+0x80f/0x9b0 [ 483.981494][T23098] ? __pfx_netlink_unicast+0x10/0x10 [ 483.981521][T23098] ? netlink_sendmsg+0x650/0xb40 [ 483.981537][T23098] ? skb_put+0x11b/0x210 [ 483.981561][T23098] netlink_sendmsg+0x813/0xb40 [ 483.981588][T23098] ? __pfx_netlink_sendmsg+0x10/0x10 [ 483.981611][T23098] ? aa_sock_msg_perm+0xf1/0x1b0 [ 483.981638][T23098] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 483.981662][T23098] ____sys_sendmsg+0x972/0x9f0 [ 483.981694][T23098] ? __pfx_____sys_sendmsg+0x10/0x10 [ 483.981726][T23098] ? import_iovec+0x73/0xa0 [ 483.981751][T23098] ___sys_sendmsg+0x2a5/0x360 [ 483.981779][T23098] ? __pfx____sys_sendmsg+0x10/0x10 [ 483.981838][T23098] ? __fget_files+0x2a/0x420 [ 483.981860][T23098] ? __fget_files+0x3a0/0x420 [ 483.981894][T23098] __x64_sys_sendmsg+0x1bd/0x2a0 [ 483.981918][T23098] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 483.981949][T23098] ? __pfx_ksys_write+0x10/0x10 [ 483.981980][T23098] do_syscall_64+0x14d/0xf80 [ 483.982001][T23098] ? trace_irq_disable+0x3b/0x150 [ 483.982016][T23098] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.982034][T23098] ? clear_bhb_loop+0x40/0x90 [ 483.982056][T23098] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.982072][T23098] RIP: 0033:0x7fb11019c819 [ 483.982089][T23098] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 483.982104][T23098] RSP: 002b:00007fb1110c4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 483.982123][T23098] RAX: ffffffffffffffda RBX: 00007fb110415fa0 RCX: 00007fb11019c819 [ 483.982136][T23098] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000004 [ 483.982146][T23098] RBP: 00007fb1110c4090 R08: 0000000000000000 R09: 0000000000000000 [ 483.982165][T23098] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 483.982176][T23098] R13: 00007fb110416038 R14: 00007fb110415fa0 R15: 00007fff93063978 [ 483.982206][T23098] [ 484.027610][ T7413] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 484.460353][ T7413] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 484.506756][ T7413] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 484.519657][ T7413] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 484.573524][T23125] netlink: 'syz.4.5398': attribute type 21 has an invalid length. [ 484.592976][T23125] IPv6: NLM_F_CREATE should be specified when creating new route [ 484.609226][ T7413] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 484.617751][ T7413] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 484.679002][ T7413] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 484.689632][ T7413] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 485.024877][T23151] netlink: 'syz.2.5405': attribute type 75 has an invalid length. [ 485.044630][T23149] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.5406'. [ 485.080769][T23149] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5406'. [ 486.519019][T23145] tap0: tun_chr_ioctl cmd 1074025678 [ 486.524678][T23145] tap0: group set to 0 [ 486.540984][T23172] bridge: RTM_NEWNEIGH with invalid state 0x8 [ 486.606560][T23176] bond4: option miimon: invalid value (18446744073709551585) [ 486.624767][T23176] bond4: option miimon: allowed values 0 - 2147483647 [ 486.654077][T23176] bond4 (unregistering): Released all slaves [ 486.823230][T23194] netdevsim netdevsim1 netdevsim0: IPsec offload requires 128 bit authentication [ 486.869636][T23195] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 486.982541][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 486.990647][ C0] lec:lec_tx_timeout: lec0 [ 486.995657][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 487.291106][T23230] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5429'. [ 487.302908][T23234] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5431'. [ 487.490060][T23251] openvswitch: netlink: EtherType 0 is less than min 600 [ 487.503422][T23252] tipc: Enabling of bearer rejected, already enabled [ 487.518151][T23249] tipc: Started in network mode [ 487.524504][T23249] tipc: Node identity 36d9081df363, cluster identity 4711 [ 487.531848][T23249] tipc: Enabled bearer , priority 10 [ 487.581031][T23249] syzkaller0: entered promiscuous mode [ 487.586807][T23249] syzkaller0: entered allmulticast mode [ 487.596500][T23249] tipc: Resetting bearer [ 487.679495][ T7415] tipc: Resetting bearer [ 487.687136][T23248] tipc: Resetting bearer [ 489.061461][T23248] tipc: Disabling bearer [ 489.072871][T23264] bond0: Device is already in use. [ 489.091624][ T9779] tipc: Node number set to 3317303325 [ 489.239540][T23290] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5445'. [ 489.649481][T23311] tipc: Enabled bearer , priority 10 [ 489.750124][T23311] syzkaller0: entered promiscuous mode [ 489.775338][T23311] syzkaller0: entered allmulticast mode [ 489.791872][T23311] tipc: Resetting bearer [ 489.861183][T23306] tipc: Resetting bearer [ 490.500114][T23339] netlink: 92 bytes leftover after parsing attributes in process `syz.4.5465'. [ 490.509562][T23339] netlink: 'syz.4.5465': attribute type 1 has an invalid length. [ 490.871577][T23358] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5469'. [ 490.928389][T23359] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5469'. [ 491.608357][T23306] tipc: Disabling bearer [ 491.627764][T23338] netlink: 'syz.4.5465': attribute type 3 has an invalid length. [ 491.635995][T23338] netlink: 'syz.4.5465': attribute type 3 has an invalid length. [ 491.824350][T23376] IPv6: addrconf: prefix option has invalid lifetime [ 491.866468][T23376] netlink: 'syz.2.5473': attribute type 1 has an invalid length. [ 491.980351][T23385] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5477'. [ 492.002417][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 492.010452][ C0] lec:lec_tx_timeout: lec0 [ 492.015630][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 492.017297][T23382] netlink: 76 bytes leftover after parsing attributes in process `syz.0.5476'. [ 492.080571][T23382] netlink: 320 bytes leftover after parsing attributes in process `syz.0.5476'. [ 492.255156][T23401] tipc: Enabled bearer , priority 10 [ 492.398170][T23401] syzkaller0: entered promiscuous mode [ 492.404334][T23401] syzkaller0: entered allmulticast mode [ 492.420938][T23401] tipc: Resetting bearer [ 492.429195][T23408] ieee802154 phy0 wpan0: encryption failed: -22 [ 492.453982][T23400] tipc: Resetting bearer [ 492.459998][T23425] netlink: 52 bytes leftover after parsing attributes in process `syz.4.5490'. [ 492.511706][T23428] netlink: 52 bytes leftover after parsing attributes in process `syz.4.5490'. [ 492.560355][T23427] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.5491'. [ 492.641024][T23433] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5492'. [ 493.947694][T23400] tipc: Disabling bearer [ 493.956602][T23425] bridge0: port 2(syz_tun) entered disabled state [ 494.224392][T23452] netlink: 52 bytes leftover after parsing attributes in process `syz.0.5499'. [ 494.235710][T23453] syzkaller1: entered promiscuous mode [ 494.241201][T23453] syzkaller1: entered allmulticast mode [ 494.363600][T23458] openvswitch: netlink: Tunnel attr 65 out of range max 16 [ 494.395886][T23466] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5503'. [ 494.466141][T23471] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5502'. [ 494.485813][T23471] netlink: 'syz.4.5502': attribute type 1 has an invalid length. [ 494.538388][T23461] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5502'. [ 494.547131][T23471] 8021q: adding VLAN 0 to HW filter on device bond4 [ 494.562095][T23461] bond4: up delay (136) is not a multiple of miimon (100), value rounded to 100 ms [ 494.607809][T23461] bond4: entered allmulticast mode [ 494.636132][T23476] tipc: Enabled bearer , priority 10 [ 494.732092][T23476] syzkaller0: entered promiscuous mode [ 494.738982][T23476] syzkaller0: entered allmulticast mode [ 494.747572][T23476] tipc: Resetting bearer [ 494.767019][T23475] tipc: Resetting bearer [ 494.770422][T23493] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5508'. [ 495.132554][T23511] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5515'. [ 496.390800][T23475] tipc: Disabling bearer [ 497.022674][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 497.030739][ C0] lec:lec_tx_timeout: lec0 [ 497.137473][T23517] udevd[23517]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 497.169034][T23517] udevd[23517]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 497.524898][T23614] __nla_validate_parse: 6 callbacks suppressed [ 497.524917][T23614] netlink: 212340 bytes leftover after parsing attributes in process `syz.2.5543'. [ 497.578549][T23614] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 497.833831][T23633] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5548'. [ 497.863595][T23636] netlink: 232 bytes leftover after parsing attributes in process `syz.1.5547'. [ 498.370572][T23667] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5556'. [ 498.404024][T23673] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5555'. [ 498.425304][T23673] netlink: 'syz.3.5555': attribute type 25 has an invalid length. [ 498.438744][T23673] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5555'. [ 498.455371][T23675] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5558'. [ 498.472929][T23675] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5558'. [ 498.484951][ T49] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 498.485100][T23673] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5555'. [ 498.497261][ T49] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 498.503220][T23673] netlink: 'syz.3.5555': attribute type 25 has an invalid length. [ 498.520801][ T49] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 498.537017][T23673] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5555'. [ 498.578599][ T49] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 498.653515][T23683] netlink: 'syz.4.5562': attribute type 1 has an invalid length. [ 498.657687][T23686] FAULT_INJECTION: forcing a failure. [ 498.657687][T23686] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 498.679054][T23686] CPU: 0 UID: 0 PID: 23686 Comm: syz.0.5563 Not tainted syzkaller #0 PREEMPT(full) [ 498.679079][T23686] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 498.679091][T23686] Call Trace: [ 498.679106][T23686] [ 498.679114][T23686] dump_stack_lvl+0xe8/0x150 [ 498.679142][T23686] should_fail_ex+0x412/0x560 [ 498.679173][T23686] _copy_from_user+0x2d/0xb0 [ 498.679195][T23686] ___sys_sendmsg+0x1c6/0x360 [ 498.679221][T23686] ? __pfx____sys_sendmsg+0x10/0x10 [ 498.679276][T23686] ? __fget_files+0x2a/0x420 [ 498.679301][T23686] ? __fget_files+0x3a0/0x420 [ 498.679334][T23686] __x64_sys_sendmsg+0x1bd/0x2a0 [ 498.679357][T23686] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 498.679383][T23686] ? __pfx_ksys_write+0x10/0x10 [ 498.679414][T23686] do_syscall_64+0x14d/0xf80 [ 498.679433][T23686] ? trace_irq_disable+0x3b/0x150 [ 498.679449][T23686] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 498.679465][T23686] ? clear_bhb_loop+0x40/0x90 [ 498.679487][T23686] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 498.679504][T23686] RIP: 0033:0x7fb11019c819 [ 498.679522][T23686] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 498.679537][T23686] RSP: 002b:00007fb1110c4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 498.679556][T23686] RAX: ffffffffffffffda RBX: 00007fb110415fa0 RCX: 00007fb11019c819 [ 498.679568][T23686] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000003 [ 498.679578][T23686] RBP: 00007fb1110c4090 R08: 0000000000000000 R09: 0000000000000000 [ 498.679589][T23686] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 498.679599][T23686] R13: 00007fb110416038 R14: 00007fb110415fa0 R15: 00007fff93063978 [ 498.679622][T23686] [ 498.690726][T23683] bond5: (slave ip6gretap1): making interface the new active one [ 498.871753][T23683] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 498.881689][T23683] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 498.891229][T23683] bond5: (slave ip6gretap1): Enslaving as an active interface with an up link [ 499.019100][T23702] netlink: 'syz.4.5569': attribute type 1 has an invalid length. [ 499.073726][T23702] 8021q: adding VLAN 0 to HW filter on device bond6 [ 499.108491][T23707] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 499.131631][T23702] bond6: (slave geneve2): making interface the new active one [ 499.172021][T23702] bond6: (slave geneve2): Enslaving as an active interface with an up link [ 499.212476][ T712] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.241869][ T712] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.308876][ T712] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.320360][ T712] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.411491][T23728] netlink: 'syz.4.5580': attribute type 10 has an invalid length. [ 499.554977][T23739] xt_TPROXY: Can be used only with -p tcp or -p udp [ 501.474623][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.482317][ T1300] lec:lec_start_xmit: lec0:No lecd attached [ 502.577153][T23743] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 502.663539][T23769] __nla_validate_parse: 5 callbacks suppressed [ 502.663558][T23769] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5591'. [ 502.724343][T23773] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5592'. [ 502.843375][T23784] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5594'. [ 503.131427][T23804] netlink: 'syz.1.5605': attribute type 13 has an invalid length. [ 503.246652][T23820] tipc: Enabled bearer , priority 0 [ 503.254757][T23824] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5608'. [ 503.265474][T23824] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5608'. [ 503.285055][T23820] syzkaller0: entered promiscuous mode [ 503.291874][T23826] openvswitch: netlink: IP tunnel TTL not specified. [ 503.299759][T23820] syzkaller0: entered allmulticast mode [ 503.307253][T23820] tipc: Resetting bearer [ 503.308863][T23829] syz.0.5611 uses old SIOCAX25GETINFO [ 503.500217][T23841] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5615'. [ 503.556036][T23841] dvmrp1: entered allmulticast mode [ 503.611876][T23843] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5614'. [ 503.781156][T23852] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5618'. [ 504.057574][T23875] syz.3.5625: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 504.078549][T23875] CPU: 1 UID: 0 PID: 23875 Comm: syz.3.5625 Not tainted syzkaller #0 PREEMPT(full) [ 504.078581][T23875] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 504.078594][T23875] Call Trace: [ 504.078603][T23875] [ 504.078612][T23875] dump_stack_lvl+0xe8/0x150 [ 504.078647][T23875] warn_alloc+0x249/0x340 [ 504.078673][T23875] ? stack_trace_save+0xa9/0x100 [ 504.078696][T23875] ? __pfx_warn_alloc+0x10/0x10 [ 504.078726][T23875] ? kasan_save_track+0x4f/0x80 [ 504.078745][T23875] ? kasan_save_track+0x3e/0x80 [ 504.078764][T23875] ? __kasan_kmalloc+0x93/0xb0 [ 504.078784][T23875] ? __kmalloc_cache_noprof+0x31c/0x660 [ 504.078805][T23875] ? xskq_create+0x56/0x170 [ 504.078824][T23875] ? xsk_setsockopt+0x54c/0x990 [ 504.078840][T23875] ? do_sock_setsockopt+0x17c/0x1b0 [ 504.078862][T23875] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 504.078883][T23875] ? do_syscall_64+0x14d/0xf80 [ 504.078908][T23875] __vmalloc_node_range_noprof+0x132/0x1730 [ 504.078959][T23875] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 504.078989][T23875] ? __kasan_kmalloc+0x93/0xb0 [ 504.079013][T23875] vmalloc_user_noprof+0xad/0xe0 [ 504.079032][T23875] ? xskq_create+0xbf/0x170 [ 504.079053][T23875] xskq_create+0xbf/0x170 [ 504.079076][T23875] xsk_init_queue+0x8a/0xe0 [ 504.079098][T23875] xsk_setsockopt+0x54c/0x990 [ 504.079120][T23875] ? __pfx_xsk_setsockopt+0x10/0x10 [ 504.079137][T23875] ? __pfx_aa_sk_perm+0x10/0x10 [ 504.079168][T23875] ? aa_sock_opt_perm+0xff/0x1a0 [ 504.079201][T23875] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 504.079224][T23875] ? __pfx_xsk_setsockopt+0x10/0x10 [ 504.079244][T23875] do_sock_setsockopt+0x17c/0x1b0 [ 504.079282][T23875] __x64_sys_setsockopt+0x13d/0x1b0 [ 504.079309][T23875] do_syscall_64+0x14d/0xf80 [ 504.079332][T23875] ? trace_irq_disable+0x3b/0x150 [ 504.079350][T23875] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 504.079372][T23875] ? clear_bhb_loop+0x40/0x90 [ 504.079397][T23875] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 504.079418][T23875] RIP: 0033:0x7f5cab19c819 [ 504.079438][T23875] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 504.079455][T23875] RSP: 002b:00007f5cac0d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 504.079477][T23875] RAX: ffffffffffffffda RBX: 00007f5cab415fa0 RCX: 00007f5cab19c819 [ 504.079493][T23875] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000007 [ 504.079507][T23875] RBP: 00007f5cab232c91 R08: 0000000000000004 R09: 0000000000000000 [ 504.079521][T23875] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 504.079533][T23875] R13: 00007f5cab416038 R14: 00007f5cab415fa0 R15: 00007ffd13a94438 [ 504.079564][T23875] [ 504.079573][T23875] Mem-Info: [ 504.171787][T23881] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5627'. [ 504.242505][T23875] active_anon:6153 inactive_anon:0 isolated_anon:0 [ 504.242505][T23875] active_file:3085 inactive_file:40474 isolated_file:0 [ 504.242505][T23875] unevictable:768 dirty:124 writeback:0 [ 504.242505][T23875] slab_reclaimable:12571 slab_unreclaimable:116694 [ 504.242505][T23875] mapped:29614 shmem:1365 pagetables:1489 [ 504.242505][T23875] sec_pagetables:0 bounce:0 [ 504.242505][T23875] kernel_misc_reclaimable:0 [ 504.242505][T23875] free:1286002 free_pcp:27593 free_cma:0 [ 504.364185][T23881] vlan2: entered promiscuous mode [ 504.412334][T23875] Node 0 active_anon:24612kB inactive_anon:0kB active_file:12340kB inactive_file:161688kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:118456kB dirty:496kB writeback:0kB shmem:3924kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:15100kB pagetables:5880kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 504.458722][T23891] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5631'. [ 504.467122][T23875] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:176kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 504.556491][T23875] Node 0 DMA free:15252kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:108kB local_pcp:48kB free_cma:0kB [ 504.594143][T23875] lowmem_reserve[]: 0 2492 2493 2493 2493 [ 504.600084][T23875] Node 0 DMA32 free:1235884kB boost:0kB min:34200kB low:42748kB high:51296kB reserved_highatomic:0KB free_highatomic:0KB active_anon:24612kB inactive_anon:0kB active_file:12340kB inactive_file:161688kB unevictable:1536kB writepending:496kB zspages:0kB present:3129332kB managed:2552644kB mlocked:0kB bounce:0kB free_pcp:53848kB local_pcp:32972kB free_cma:0kB [ 504.639424][T23875] lowmem_reserve[]: 0 0 0 0 0 [ 504.645425][T23875] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:880kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 504.679331][T23875] lowmem_reserve[]: 0 0 0 0 0 [ 504.684442][T23875] Node 1 Normal free:3892616kB boost:0kB min:55688kB low:69608kB high:83528kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:57240kB local_pcp:26480kB free_cma:0kB [ 504.740190][T23875] lowmem_reserve[]: 0 0 0 0 0 [ 504.745511][T23875] Node 0 DMA: 1*4kB (U) 0*8kB 1*16kB (U) 0*32kB 2*64kB (U) 2*128kB (U) 2*256kB (U) 2*512kB (U) 3*1024kB (U) 3*2048kB (UM) 1*4096kB (U) = 15252kB [ 504.772585][T23875] Node 0 DMA32: 7142*4kB (UME) 4906*8kB (UME) 1674*16kB (UME) 435*32kB (UM) 84*64kB (UME) 551*128kB (UME) 602*256kB (UM) 480*512kB (UME) 329*1024kB (UM) 154*2048kB (UM) 0*4096kB = 1236584kB [ 504.798254][T23875] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 504.830478][T23875] Node 1 Normal: 9*4kB (UM) 14*8kB (UM) 11*16kB (UM) 10*32kB (UM) 16*64kB (UM) 10*128kB (UM) 7*256kB (UM) 8*512kB (UM) 7*1024kB (UM) 3*2048kB (U) 945*4096kB (UM) = 3892868kB [ 504.879437][T23875] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 504.915172][T23875] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 504.942837][T23875] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 504.962191][T23875] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 505.038167][T23875] 45741 total pagecache pages [ 505.051599][T23875] 0 pages in swap cache [ 505.056931][T23875] Free swap = 124996kB [ 505.061114][T23875] Total swap = 124996kB [ 505.082312][T23875] 2097051 pages RAM [ 505.089496][T23875] 0 pages HighMem/MovableOnly [ 505.112317][T23875] 427055 pages reserved [ 505.121988][T23875] 0 pages cma reserved [ 505.283147][T23932] netdevsim netdevsim0 netdevsim0: IPsec offload requires 128 bit authentication [ 505.716641][T23961] xt_CT: No such helper "snmp_trap" [ 505.944359][T23977] bond4 (unregistering): Released all slaves [ 506.176783][T23996] veth0: entered promiscuous mode [ 506.197161][T23995] veth0: left promiscuous mode [ 506.312504][T24007] syzkaller1: entered promiscuous mode [ 506.318505][T24007] syzkaller1: entered allmulticast mode [ 506.405773][T24012] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 506.486042][T24016] netlink: 'syz.2.5667': attribute type 12 has an invalid length. [ 506.757887][T24041] syz_tun: entered allmulticast mode [ 506.902424][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5420 ms [ 506.910495][ C0] lec:lec_tx_timeout: lec0 [ 506.943313][ T7998] lec:lec_start_xmit: lec0:No lecd attached [ 506.947977][T24053] vcan0: entered allmulticast mode [ 506.985816][T24058] syzkaller1: entered promiscuous mode [ 506.998395][T24058] syzkaller1: entered allmulticast mode [ 507.018560][T24062] netlink: 'syz.3.5683': attribute type 8 has an invalid length. [ 507.188700][T24074] netlink: 'syz.1.5686': attribute type 1 has an invalid length. [ 507.259475][T24079] openvswitch: netlink: Flow actions attr not present in new flow. [ 507.494638][T24106] syzkaller1: entered promiscuous mode [ 507.500867][T24106] syzkaller1: entered allmulticast mode [ 507.645080][T24114] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 507.654085][T24114] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 507.661854][T24114] batman_adv: batadv0: Removing interface: gretap1 [ 508.422113][T24128] __nla_validate_parse: 14 callbacks suppressed [ 508.422127][T24128] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5704'. [ 508.659632][T24166] syzkaller1: entered promiscuous mode [ 508.667679][T24166] syzkaller1: entered allmulticast mode [ 510.294791][T24085] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 510.309689][T24123] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5702'. [ 510.333406][T24187] netlink: 'syz.0.5711': attribute type 1 has an invalid length. [ 510.374040][T24187] netlink: 224 bytes leftover after parsing attributes in process `syz.0.5711'. [ 510.464851][T24193] netlink: 'syz.1.5712': attribute type 12 has an invalid length. [ 510.579956][T24203] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.5719'. [ 510.602118][T24208] netlink: 220 bytes leftover after parsing attributes in process `syz.0.5716'. [ 510.662103][T24208] netlink: 'syz.0.5716': attribute type 2 has an invalid length. [ 510.812239][T24214] syzkaller1: entered promiscuous mode [ 510.840099][T24214] syzkaller1: entered allmulticast mode [ 510.932530][T24222] netlink: 96 bytes leftover after parsing attributes in process `syz.4.5723'. [ 510.936155][T24220] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5722'. [ 510.990848][T24222] 8021q: VLANs not supported on gre0 [ 511.233948][T24229] ieee802154 phy0 wpan0: encryption failed: -22 [ 511.268323][T24233] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5728'. [ 511.301155][T24237] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5729'. [ 511.328242][T24237] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5729'. [ 511.440957][T24247] netdevsim netdevsim3 netdevsim0: IPsec offload requires 128 bit authentication [ 511.561502][T24255] openvswitch: netlink: nsh attr 255 is out of range max 3 [ 511.591134][T24257] syzkaller0: entered promiscuous mode [ 511.613174][T24257] syzkaller0: entered allmulticast mode [ 511.699219][T24266] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 511.952443][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 511.960603][ C0] lec:lec_tx_timeout: lec0 [ 512.465895][T24311] netlink: 'syz.3.5754': attribute type 11 has an invalid length. [ 512.509353][T24311] netlink: 'syz.3.5754': attribute type 4 has an invalid length. [ 512.524240][T24311] netlink: 'syz.3.5754': attribute type 5 has an invalid length. [ 512.543908][T24311] netlink: 'syz.3.5754': attribute type 6 has an invalid length. [ 512.690453][T24327] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 512.832586][ T29] audit: type=1107 audit(1775181168.884:4): pid=24329 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='¾ÏäqçJþ®ƒŸº›ë°àÙ-ÉÚ™™êfÚ^Kw¤yý¬„æ>®›oÊoàÑæ¨G¹Ã!&õª;`˜Ó1¡Ò JìÓ÷m$çGLT¦}q3»E²ÃÈäGY' [ 512.895508][T24340] veth0: entered promiscuous mode [ 512.911025][T24338] vlan1: entered allmulticast mode [ 512.932543][T24338] bridge9: entered allmulticast mode [ 512.953905][T24339] veth0: left promiscuous mode [ 513.547717][T24387] netdevsim netdevsim3 netdevsim0: IPsec offload requires 128 bit authentication [ 513.563283][T24386] __nla_validate_parse: 12 callbacks suppressed [ 513.563304][T24386] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5775'. [ 513.741788][T24376] geneve3: entered promiscuous mode [ 513.758468][T24181] netdevsim netdevsim4 eth0: set [1, 1] type 2 family 0 port 52385 - 0 [ 513.776615][T24181] netdevsim netdevsim4 eth1: set [1, 1] type 2 family 0 port 52385 - 0 [ 513.786176][T24181] netdevsim netdevsim4 eth2: set [1, 1] type 2 family 0 port 52385 - 0 [ 513.826151][T24181] netdevsim netdevsim4 eth3: set [1, 1] type 2 family 0 port 52385 - 0 [ 513.869252][T24392] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5778'. [ 513.960840][T24411] netlink: 48 bytes leftover after parsing attributes in process `syz.3.5778'. [ 514.050494][T24418] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5785'. [ 514.099544][T24418] hsr_slave_0: left promiscuous mode [ 514.347148][T24429] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5790'. [ 514.431188][T24428] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5789'. [ 514.704281][T24456] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5799'. [ 515.089140][T24478] syzkaller1: entered promiscuous mode [ 515.111546][T24478] syzkaller1: entered allmulticast mode [ 515.220086][T24484] team0: No ports can be present during mode change [ 515.345337][T24498] netlink: 'syz.0.5812': attribute type 33 has an invalid length. [ 515.395015][T24488] veth7: entered allmulticast mode [ 515.440092][T24498] bond4: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 515.456114][T24498] bond4 (unregistering): Released all slaves [ 515.464886][T24501] netlink: 'syz.0.5812': attribute type 2 has an invalid length. [ 515.508112][T24504] IPVS: set_ctl: invalid protocol: 47 127.0.0.1:20001 [ 515.662544][T24516] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5816'. [ 515.716991][T24520] netlink: 64 bytes leftover after parsing attributes in process `syz.1.5818'. [ 515.755380][T24520] netlink: 'syz.1.5818': attribute type 1 has an invalid length. [ 515.773464][T24528] openvswitch: netlink: Tunnel attr 78 out of range max 16 [ 515.790329][T24520] netlink: 'syz.1.5818': attribute type 2 has an invalid length. [ 516.075779][T24554] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5829'. [ 516.152388][T24554] vlan9: entered allmulticast mode [ 516.165488][T24554] bridge11: entered allmulticast mode [ 516.184452][T24554] erspan0: left promiscuous mode [ 516.196832][T24554] bridge9: port 1(erspan0) entered disabled state [ 516.479570][T24554] bridge11: port 1(erspan0) entered blocking state [ 516.486508][T24554] bridge11: port 1(erspan0) entered disabled state [ 516.496266][T24554] erspan0: entered promiscuous mode [ 516.693449][T24565] xt_recent: hitcount (4294901760) is larger than allowed maximum (65535) [ 516.782231][T24565] dvmrp0: entered allmulticast mode [ 516.813720][T24572] netlink: 'syz.1.5835': attribute type 1 has an invalid length. [ 516.891408][T24180] dummy0: left allmulticast mode [ 516.912952][T24180] bridge0: port 1(dummy0) entered disabled state [ 516.960791][T24180] erspan0: left promiscuous mode [ 516.976332][T24180] bridge4: port 1(erspan0) entered disabled state [ 517.523621][T24180] bond5 (unregistering): (slave bridge5): Releasing backup interface [ 517.532145][T24180] bridge5 (unregistering): left promiscuous mode [ 517.567772][T24180] bond0 (unregistering): Released all slaves [ 517.583452][T24180] bond1 (unregistering): Released all slaves [ 517.599275][T24180] bond2 (unregistering): Released all slaves [ 517.615678][T24180] bond3 (unregistering): Released all slaves [ 517.631700][T24180] bond4 (unregistering): Released all slaves [ 517.645645][T24180] bond5 (unregistering): Released all slaves [ 517.668828][T24599] 8021q: VLANs not supported on ip_vti0 [ 517.813315][T24180] tipc: Disabling bearer [ 517.830783][T24180] tipc: Left network mode [ 517.985831][T24180] IPVS: stopping master sync thread 8629 ... [ 518.295897][T24642] tipc: Enabling of bearer rejected, already enabled [ 518.304580][T24643] netdevsim netdevsim0 netdevsim0: IPsec offload requires 128 bit authentication [ 518.370393][T24641] netlink: 'syz.1.5855': attribute type 3 has an invalid length. [ 518.514707][T24654] netlink: 'syz.0.5859': attribute type 32 has an invalid length. [ 518.578372][T24180] hsr0: left allmulticast mode [ 518.587778][T24180] veth0_macvtap: left promiscuous mode [ 518.593897][T24180] veth1_vlan: left promiscuous mode [ 518.599197][T24180] veth0_vlan: left promiscuous mode [ 518.648644][T24669] netlink: 'syz.1.5865': attribute type 3 has an invalid length. [ 518.668150][T24669] __nla_validate_parse: 38 callbacks suppressed [ 518.668168][T24669] netlink: 224 bytes leftover after parsing attributes in process `syz.1.5865'. [ 518.685832][T24672] netlink: 'syz.0.5859': attribute type 10 has an invalid length. [ 518.707955][T24669] netlink: 'syz.1.5865': attribute type 1 has an invalid length. [ 518.721330][T24674] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5867'. [ 518.993962][T24654] bond4: Setting coupled_control to off (0) [ 519.051576][T24678] vlan10: entered allmulticast mode [ 519.058844][T24678] bridge12: entered allmulticast mode [ 519.081915][T24682] erspan0: left allmulticast mode [ 519.100485][T24682] erspan0: left promiscuous mode [ 519.106435][T24682] bridge11: port 1(erspan0) entered disabled state [ 519.159533][T24682] bridge12: port 1(erspan0) entered blocking state [ 519.179124][T24682] bridge12: port 1(erspan0) entered disabled state [ 519.196261][T24682] erspan0: entered allmulticast mode [ 519.214296][T24682] erspan0: entered promiscuous mode [ 519.240469][T24685] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5869'. [ 519.370943][ T5827] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 519.398323][ T5827] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 519.407067][ T5827] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 519.418885][ T5827] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 519.429989][ T5827] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 519.446286][T24698] tipc: Enabled bearer , priority 0 [ 519.569718][T24698] syzkaller0: entered promiscuous mode [ 519.593263][T24698] syzkaller0: entered allmulticast mode [ 519.613430][T24698] tipc: Resetting bearer [ 519.636831][T24701] Bluetooth: MGMT ver 1.23 [ 519.639252][T24691] lo speed is unknown, defaulting to 1000 [ 519.671295][T24694] tipc: Resetting bearer [ 519.683701][T24710] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5878'. [ 519.793309][T24713] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5878'. [ 519.815422][T24713] nbd: device at index 64 is going down [ 520.065991][T24637] udevd[24637]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 520.136173][T24724] netlink: 'syz.4.5880': attribute type 1 has an invalid length. [ 520.204154][T24726] netlink: 'syz.4.5880': attribute type 30 has an invalid length. [ 521.334830][T24694] tipc: Disabling bearer [ 521.371470][T24704] lo speed is unknown, defaulting to 1000 [ 521.384728][T24726] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 521.398345][T24180] IPVS: stop unused estimator thread 0... [ 521.453093][T24729] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5881'. [ 521.473028][ T51] Bluetooth: hci0: command tx timeout [ 521.576739][T24734] netlink: 'syz.2.5883': attribute type 4 has an invalid length. [ 521.628440][T24738] netlink: 'syz.4.5884': attribute type 1 has an invalid length. [ 521.722899][T24746] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5888'. [ 521.786144][T24746] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5888'. [ 522.035362][T24691] chnl_net:caif_netlink_parms(): no params data found [ 522.161451][T24769] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5894'. [ 522.208814][T24771] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5895'. [ 522.390423][T24691] bridge0: port 1(bridge_slave_0) entered blocking state [ 522.397838][T24691] bridge0: port 1(bridge_slave_0) entered disabled state [ 522.407953][T24691] bridge_slave_0: entered allmulticast mode [ 522.420457][T24691] bridge_slave_0: entered promiscuous mode [ 522.428945][T24781] netlink: 'syz.4.5898': attribute type 29 has an invalid length. [ 522.440738][T24691] bridge0: port 2(bridge_slave_1) entered blocking state [ 522.450734][T24691] bridge0: port 2(bridge_slave_1) entered disabled state [ 522.458179][T24691] bridge_slave_1: entered allmulticast mode [ 522.466151][T24691] bridge_slave_1: entered promiscuous mode [ 522.520786][T24691] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 522.534535][T24691] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 522.636445][T24691] team0: Port device team_slave_0 added [ 522.655070][T24691] team0: Port device team_slave_1 added [ 522.700224][T24691] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 522.707336][T24691] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 522.733810][T24691] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 522.746652][T24691] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 522.753978][T24691] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 522.780378][T24691] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 522.811617][T24803] syzkaller0: entered promiscuous mode [ 522.817164][T24803] syzkaller0: entered allmulticast mode [ 522.878030][T24691] hsr_slave_0: entered promiscuous mode [ 522.886536][T24691] hsr_slave_1: entered promiscuous mode [ 522.894035][T24806] lo speed is unknown, defaulting to 1000 [ 523.011997][T24811] bond_slave_0: Caught tx_queue_len zero misconfig [ 523.153098][T24691] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 523.248889][T24691] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 523.373761][T24691] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 523.556689][ T51] Bluetooth: hci0: command tx timeout [ 524.806557][T24691] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 525.103486][T24849] __nla_validate_parse: 4 callbacks suppressed [ 525.103507][T24849] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5914'. [ 525.350198][T24856] pim6reg527: entered allmulticast mode [ 525.500345][T24788] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 525.523288][T24863] netlink: 'syz.3.5918': attribute type 9 has an invalid length. [ 525.545889][T24691] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 525.586528][T24691] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 525.629821][T24691] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 525.639958][ T51] Bluetooth: hci0: command tx timeout [ 525.676884][T24691] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 525.916814][T24691] 8021q: adding VLAN 0 to HW filter on device bond0 [ 525.971895][T24691] 8021q: adding VLAN 0 to HW filter on device team0 [ 526.004614][T24891] netlink: 'syz.3.5925': attribute type 1 has an invalid length. [ 526.014890][T24181] bridge0: port 1(bridge_slave_0) entered blocking state [ 526.022014][T24181] bridge0: port 1(bridge_slave_0) entered forwarding state [ 526.069992][T24893] netlink: 152 bytes leftover after parsing attributes in process `syz.4.5926'. [ 526.103994][T24891] 8021q: adding VLAN 0 to HW filter on device bond12 [ 526.140619][T24896] vlan11: entered allmulticast mode [ 526.158481][T24896] bond12: entered allmulticast mode [ 526.167444][T24179] bridge0: port 2(bridge_slave_1) entered blocking state [ 526.174683][T24179] bridge0: port 2(bridge_slave_1) entered forwarding state [ 526.227544][T24896] netlink: 80 bytes leftover after parsing attributes in process `syz.3.5925'. [ 526.300931][T24891] bond12: (slave geneve4): making interface the new active one [ 526.322563][T24891] geneve4: entered allmulticast mode [ 526.334672][T24891] bond12: (slave geneve4): Enslaving as an active interface with an up link [ 526.362467][T24179] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 526.381613][T24179] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 526.419394][T24179] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 526.449955][T24179] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 526.723348][T24918] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5930'. [ 526.861853][T24911] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5930'. [ 526.872098][T24691] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 526.922710][T24911] nbd: device at index 64 is going down [ 526.935703][T24691] veth0_vlan: entered promiscuous mode [ 526.985027][T24691] veth1_vlan: entered promiscuous mode [ 527.018339][T24928] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5932'. [ 527.089010][T24691] veth0_macvtap: entered promiscuous mode [ 527.099841][T24637] udevd[24637]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 527.127593][T24691] veth1_macvtap: entered promiscuous mode [ 527.146403][T24932] 8021q: VLANs not supported on ip_vti0 [ 527.186516][T24691] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 527.211886][T24691] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 527.255300][T24182] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 527.279188][T24182] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 527.309336][T24182] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 527.335087][T24182] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 527.551787][T24181] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 527.584777][T24181] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 527.618153][T24951] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5937'. [ 527.628440][T24180] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 527.655290][T24180] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 527.707150][ T51] Bluetooth: hci0: command tx timeout [ 527.741719][T24960] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5939'. [ 528.187256][ T5827] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 528.197299][ T5827] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 528.220622][ T5827] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 528.239666][ T5827] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 528.249102][ T5827] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 528.355080][T24976] lo speed is unknown, defaulting to 1000 [ 528.372845][T24982] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5945'. [ 528.431295][T24984] bond0: Caught tx_queue_len zero misconfig [ 528.632612][T24995] sctp: [Deprecated]: syz.1.5950 (pid 24995) Use of int in max_burst socket option deprecated. [ 528.632612][T24995] Use struct sctp_assoc_value instead [ 528.994584][T25012] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5956'. [ 529.436192][T24976] chnl_net:caif_netlink_parms(): no params data found [ 529.679254][T25040] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 529.689755][ T9790] IPVS: starting estimator thread 0... [ 529.751586][T24976] bridge0: port 1(bridge_slave_0) entered blocking state [ 529.787167][T24976] bridge0: port 1(bridge_slave_0) entered disabled state [ 529.807102][T24976] bridge_slave_0: entered allmulticast mode [ 529.815919][T25045] IPVS: using max 36 ests per chain, 86400 per kthread [ 529.837912][T24976] bridge_slave_0: entered promiscuous mode [ 529.873822][T24976] bridge0: port 2(bridge_slave_1) entered blocking state [ 529.889288][T24976] bridge0: port 2(bridge_slave_1) entered disabled state [ 529.907681][T24976] bridge_slave_1: entered allmulticast mode [ 529.926083][T24976] bridge_slave_1: entered promiscuous mode [ 529.943744][T25048] netlink: 'syz.0.5966': attribute type 3 has an invalid length. [ 529.951549][T25048] netlink: 'syz.0.5966': attribute type 1 has an invalid length. [ 530.015494][T24976] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 530.058397][T24976] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 530.160121][T24976] team0: Port device team_slave_0 added [ 530.182670][ T5827] Bluetooth: hci0: command tx timeout [ 530.183304][T24976] team0: Port device team_slave_1 added [ 530.256978][T24976] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 530.266295][T24976] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 530.294026][T24976] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 530.309531][T24976] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 530.324634][T25069] netlink: 'syz.4.5972': attribute type 6 has an invalid length. [ 530.343842][ T5827] Bluetooth: hci3: command tx timeout [ 530.373704][T24976] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 530.410969][T24976] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 530.451468][T25070] wireguard0: entered promiscuous mode [ 530.525046][T25070] wireguard0: entered allmulticast mode [ 530.547323][T25070] team0: Device wireguard0 is of different type [ 530.644724][T24976] hsr_slave_0: entered promiscuous mode [ 530.651525][T24976] hsr_slave_1: entered promiscuous mode [ 530.673273][T24976] debugfs: 'hsr0' already exists in 'hsr' [ 530.685598][T24976] Cannot create hsr debugfs directory [ 530.696283][T25083] netdevsim netdevsim1 netdevsim0: IPsec offload requires 128 bit authentication [ 530.856758][ T9778] IPVS: starting estimator thread 0... [ 530.962970][T25088] IPVS: using max 28 ests per chain, 67200 per kthread [ 531.069727][T24976] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 531.097803][T24976] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 531.228839][T24976] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 531.248523][T24976] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 531.305420][T25107] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5983'. [ 531.331448][T24976] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 531.342221][T24976] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 531.439071][T24976] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 531.461905][T24976] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 531.485869][T25110] netem: incorrect gi model size [ 531.533191][T25115] netlink: 10 bytes leftover after parsing attributes in process `syz.1.5986'. [ 531.556401][T25110] 8021q: VLANs not supported on caif0 [ 531.588216][T25115] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input7 [ 531.779024][T25125] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5988'. [ 531.799619][T24976] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 531.814881][T24976] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 531.877812][T24976] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 531.907818][T24976] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 531.951011][T25130] netlink: 56 bytes leftover after parsing attributes in process `syz.2.5990'. [ 531.958032][T25136] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5989'. [ 532.028801][T25148] Bluetooth: MGMT ver 1.23 [ 532.152784][T25152] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5994'. [ 532.215840][T24976] 8021q: adding VLAN 0 to HW filter on device bond0 [ 532.269436][T25150] netlink: 224 bytes leftover after parsing attributes in process `syz.4.5994'. [ 532.269958][T24976] 8021q: adding VLAN 0 to HW filter on device team0 [ 532.289392][T25150] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5994'. [ 532.303866][T25164] netdevsim netdevsim0 netdevsim0: IPsec offload requires 128 bit authentication [ 532.314205][T24182] bridge0: port 1(bridge_slave_0) entered blocking state [ 532.321448][T24182] bridge0: port 1(bridge_slave_0) entered forwarding state [ 532.332287][T25161] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5996'. [ 532.349797][T24181] bridge0: port 2(bridge_slave_1) entered blocking state [ 532.357008][T24181] bridge0: port 2(bridge_slave_1) entered forwarding state [ 532.423137][ T5827] Bluetooth: hci3: command tx timeout [ 532.521274][T25173] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 532.689168][T24976] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 532.706690][T25184] netlink: 'syz.4.6001': attribute type 16 has an invalid length. [ 532.730039][T25184] netlink: 'syz.4.6001': attribute type 17 has an invalid length. [ 532.761303][T25184] bridge8: port 1(erspan0) entered disabled state [ 532.786206][T25184] 8021q: adding VLAN 0 to HW filter on device bond0 [ 532.795280][T25184] 8021q: adding VLAN 0 to HW filter on device team0 [ 532.805885][T25184] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 532.825390][T24976] veth0_vlan: entered promiscuous mode [ 532.862181][T24976] veth1_vlan: entered promiscuous mode [ 532.928922][T24976] veth0_macvtap: entered promiscuous mode [ 532.948985][T24976] veth1_macvtap: entered promiscuous mode [ 532.964899][T25191] netlink: 'syz.0.6004': attribute type 1 has an invalid length. [ 532.975939][T24976] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 532.995660][T24976] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 533.008233][T25193] delete_channel: no stack [ 533.019786][T24179] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 533.029753][T24179] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 533.041587][T24179] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 533.066031][T24179] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 533.083955][T25193] netlink: 'syz.4.6005': attribute type 1 has an invalid length. [ 533.092194][T25193] netlink: 96 bytes leftover after parsing attributes in process `syz.4.6005'. [ 533.111576][T25193] netlink: 'syz.4.6005': attribute type 1 has an invalid length. [ 533.120333][T25193] netlink: 'syz.4.6005': attribute type 8 has an invalid length. [ 533.130634][T25193] sctp: [Deprecated]: syz.4.6005 (pid 25193) Use of int in maxseg socket option. [ 533.130634][T25193] Use struct sctp_assoc_value instead [ 533.306633][T24179] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 533.330421][T24179] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 533.381675][T25204] netlink: 'syz.0.6009': attribute type 1 has an invalid length. [ 533.408106][T24182] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 533.436116][T24182] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 533.614383][T25216] bond19: entered promiscuous mode [ 533.619677][T25216] bond19: entered allmulticast mode [ 533.626682][T25216] 8021q: adding VLAN 0 to HW filter on device bond19 [ 533.627473][T25225] netlink: 'syz.0.6016': attribute type 21 has an invalid length. [ 533.676847][T25226] syzkaller1: entered promiscuous mode [ 533.699634][T25226] syzkaller1: entered allmulticast mode [ 534.037255][ T51] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 534.046699][ T51] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 534.055369][ T51] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 534.063594][ T51] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 534.071386][ T51] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 534.136280][T25237] lo speed is unknown, defaulting to 1000 [ 534.375388][T25258] netlink: 'syz.3.6026': attribute type 13 has an invalid length. [ 534.398489][T15371] bridge0: port 2(syz_tun) entered disabled state [ 534.447770][T15371] syz_tun (unregistering): left allmulticast mode [ 534.457979][T15371] syz_tun (unregistering): left promiscuous mode [ 534.465106][T15371] bridge0: port 2(syz_tun) entered disabled state [ 534.503999][ T5827] Bluetooth: hci3: command tx timeout [ 534.698371][T25274] netlink: 'syz.2.6032': attribute type 4 has an invalid length. [ 534.859930][T25269] bridge12: port 1(erspan0) entered disabled state [ 534.872983][T25286] IPVS: length: 4096 != 24 [ 535.085861][T25296] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'syz0' [ 535.446857][T24181] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 535.458369][T24181] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 535.469498][T24181] netdevsim netdevsim4 eth3 (unregistering): unset [1, 1] type 2 family 0 port 52385 - 0 [ 535.495855][T25275] lo: entered allmulticast mode [ 535.500930][T25275] lo: left allmulticast mode [ 535.518811][T25281] bond0 (unregistering): left promiscuous mode [ 535.535919][T25281] bond_slave_0: left promiscuous mode [ 535.547099][T25281] bond_slave_1: left promiscuous mode [ 535.555677][T25281] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 535.575804][T25281] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 535.589758][T25281] bond0 (unregistering): Released all slaves [ 535.608981][T24182] netdevsim netdevsim2 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 535.619830][T24182] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 535.639544][T24182] netdevsim netdevsim2 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 535.648692][T24182] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 535.667934][T24182] netdevsim netdevsim2 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 535.677408][T24182] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 535.706725][T24182] netdevsim netdevsim2 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 535.735079][T24182] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 535.775228][T24181] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 535.787393][T24181] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 535.803169][T24181] netdevsim netdevsim4 eth2 (unregistering): unset [1, 1] type 2 family 0 port 52385 - 0 [ 535.935186][T24181] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 535.959558][T24181] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 535.970942][T24181] netdevsim netdevsim4 eth1 (unregistering): unset [1, 1] type 2 family 0 port 52385 - 0 [ 536.085378][T24181] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 536.102788][ T5827] Bluetooth: hci5: command tx timeout [ 536.140806][T24181] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 536.169014][T24181] netdevsim netdevsim4 eth0 (unregistering): unset [1, 1] type 2 family 0 port 52385 - 0 [ 536.233322][T25334] xt_l2tp: wrong L2TP version: 0 [ 536.375141][T25338] __nla_validate_parse: 6 callbacks suppressed [ 536.375160][T25338] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6051'. [ 536.414653][T25237] chnl_net:caif_netlink_parms(): no params data found [ 536.567798][T25356] netlink: 56 bytes leftover after parsing attributes in process `syz.0.6055'. [ 536.582886][ T5827] Bluetooth: hci3: command tx timeout [ 536.615046][T25356] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6055'. [ 536.673678][T25356] netlink: 31 bytes leftover after parsing attributes in process `syz.0.6055'. [ 536.688194][T25356] netlink: 31 bytes leftover after parsing attributes in process `syz.0.6055'. [ 536.894763][T24181] veth5: left allmulticast mode [ 536.910408][T24181] veth5: left promiscuous mode [ 536.920762][T24181] bridge7: port 2(veth5) entered disabled state [ 536.988116][T25379] netlink: 220 bytes leftover after parsing attributes in process `syz.2.6060'. [ 536.998480][T24181] veth3: left allmulticast mode [ 537.012387][T24181] veth3: left promiscuous mode [ 537.017489][T24181] bridge7: port 1(veth3) entered disabled state [ 537.054872][T24181] erspan0: left allmulticast mode [ 537.075749][T24181] erspan0: left promiscuous mode [ 537.080911][T24181] bridge8: port 1(erspan0) entered disabled state [ 537.406905][T24181] bond5 (unregistering): (slave ip6gretap1): Releasing active interface [ 537.620262][T24181] gretap0 (unregistering): left promiscuous mode [ 537.675501][T24181] dvmrp0 (unregistering): left allmulticast mode [ 537.699902][T24181] bond6 (unregistering): (slave geneve2): Releasing active interface [ 537.755522][T24181] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 537.765659][T24181] bridge0 (unregistering): left promiscuous mode [ 538.016376][T24181] bond3 (unregistering): (slave bridge6): Releasing backup interface [ 538.025277][T24181] bridge6 (unregistering): left promiscuous mode [ 538.178181][T24181] bond0 (unregistering): left promiscuous mode [ 538.184859][ T5827] Bluetooth: hci5: command tx timeout [ 538.188038][T24181] bond_slave_0: left promiscuous mode [ 538.195848][T24181] bond_slave_1: left promiscuous mode [ 538.202868][T24181] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 538.214234][T24181] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 538.224214][T24181] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 538.233804][T24181] bond0 (unregistering): Released all slaves [ 538.243520][T24181] bond1 (unregistering): Released all slaves [ 538.257000][T24181] bond2 (unregistering): Released all slaves [ 538.271326][T24181] bond3 (unregistering): Released all slaves [ 538.289049][T24181] bond4 (unregistering): Released all slaves [ 538.301266][T24181] bond5 (unregistering): Released all slaves [ 538.314322][T24181] bond6 (unregistering): Released all slaves [ 538.326964][T24181] bond7 (unregistering): Released all slaves [ 538.340762][T25237] bridge0: port 1(bridge_slave_0) entered blocking state [ 538.352661][T25237] bridge0: port 1(bridge_slave_0) entered disabled state [ 538.360024][T25237] bridge_slave_0: entered allmulticast mode [ 538.368321][T25237] bridge_slave_0: entered promiscuous mode [ 538.400784][T25399] tipc: Started in network mode [ 538.407087][T25399] tipc: Node identity 1e9cd870920f, cluster identity 4711 [ 538.415052][T25399] tipc: Enabled bearer , priority 0 [ 538.447322][T25237] bridge0: port 2(bridge_slave_1) entered blocking state [ 538.457762][T25237] bridge0: port 2(bridge_slave_1) entered disabled state [ 538.466647][T25237] bridge_slave_1: entered allmulticast mode [ 538.479195][T25237] bridge_slave_1: entered promiscuous mode [ 538.545960][T25399] tipc: Disabling bearer [ 538.647103][T24181] tipc: Disabling bearer [ 538.676335][T24181] tipc: Disabling bearer [ 538.717281][T24181] tipc: Left network mode [ 538.727536][T25237] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 538.757079][T25237] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 538.874473][T25237] team0: Port device team_slave_0 added [ 538.895067][T25237] team0: Port device team_slave_1 added [ 538.950086][T25435] validate_nla: 4 callbacks suppressed [ 538.950105][T25435] netlink: 'syz.2.6073': attribute type 1 has an invalid length. [ 538.999768][T25237] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 539.044739][T25237] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 539.106085][T24181] IPVS: stopping master sync thread 15996 ... [ 539.107423][T25445] netlink: 'syz.0.6076': attribute type 13 has an invalid length. [ 539.142254][T25237] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 539.211701][T25445] veth0_macvtap: left promiscuous mode [ 539.276586][T25445] macvtap0: entered allmulticast mode [ 539.292304][T25445] macvtap0: refused to change device tx_queue_len [ 539.293990][T25461] netlink: 'syz.1.6078': attribute type 1 has an invalid length. [ 539.400047][T25468] netlink: 256 bytes leftover after parsing attributes in process `syz.2.6079'. [ 539.416432][T25468] netlink: 256 bytes leftover after parsing attributes in process `syz.2.6079'. [ 539.436726][T25468] netlink: 256 bytes leftover after parsing attributes in process `syz.2.6079'. [ 539.462070][T25237] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 539.509251][T25237] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 539.561298][T25237] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 539.640848][T25482] openvswitch: netlink: IP tunnel dst address not specified [ 539.655775][T25454] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6078'. [ 539.836408][T25461] bond0: entered promiscuous mode [ 539.885598][T25461] 8021q: adding VLAN 0 to HW filter on device bond0 [ 539.947314][T25495] 8021q: VLANs not supported on ip_vti0 [ 539.972276][T25498] netlink: 'syz.3.6085': attribute type 1 has an invalid length. [ 540.136348][T25237] hsr_slave_0: entered promiscuous mode [ 540.159419][T25237] hsr_slave_1: entered promiscuous mode [ 540.174231][T25237] debugfs: 'hsr0' already exists in 'hsr' [ 540.231272][T25237] Cannot create hsr debugfs directory [ 540.262645][ T5827] Bluetooth: hci5: command tx timeout [ 541.058139][T25537] h: entered promiscuous mode [ 541.160784][T25541] tipc: Started in network mode [ 541.170816][T25541] tipc: Node identity ac14140b, cluster identity 4711 [ 541.187052][T25541] tipc: New replicast peer: 172.20.20.187 [ 541.199397][T25541] tipc: Enabled bearer , priority 10 [ 541.255828][T24181] veth0_to_team: left promiscuous mode [ 541.672993][T24181] team0 (unregistering): Port device team_slave_1 removed [ 541.697602][T24181] team0 (unregistering): Port device team_slave_0 removed [ 541.851402][T24181] vcan0 (unregistering): left allmulticast mode [ 541.913094][T25546] netlink: 'syz.1.6095': attribute type 12 has an invalid length. [ 541.925143][T25546] netlink: 'syz.1.6095': attribute type 29 has an invalid length. [ 541.935210][T25546] __nla_validate_parse: 5 callbacks suppressed [ 541.935227][T25546] netlink: 148 bytes leftover after parsing attributes in process `syz.1.6095'. [ 541.951158][T25546] netlink: 59 bytes leftover after parsing attributes in process `syz.1.6095'. [ 542.344907][ T5827] Bluetooth: hci5: command tx timeout [ 542.370523][ T9778] tipc: Node number set to 2886997003 [ 542.383889][T25568] netlink: zone id is out of range [ 542.389045][T25568] netlink: zone id is out of range [ 542.416595][T25568] netlink: del zone limit has 4 unknown bytes [ 542.836395][T25237] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 542.894821][T25237] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 542.946228][T25237] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 542.968806][T25237] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 542.996941][T25589] netlink: 'syz.0.6103': attribute type 83 has an invalid length. [ 543.184361][T25237] 8021q: adding VLAN 0 to HW filter on device bond0 [ 543.219730][T25237] 8021q: adding VLAN 0 to HW filter on device team0 [ 543.241253][T24177] bridge0: port 1(bridge_slave_0) entered blocking state [ 543.248457][T24177] bridge0: port 1(bridge_slave_0) entered forwarding state [ 543.276908][T24177] bridge0: port 2(bridge_slave_1) entered blocking state [ 543.284084][T24177] bridge0: port 2(bridge_slave_1) entered forwarding state [ 543.339068][T25610] openvswitch: netlink: Invalid VLAN frame [ 543.463640][T25618] openvswitch: netlink: Geneve opt len 1 is not a multiple of 4. [ 543.597886][T25625] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6115'. [ 543.615089][T25629] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6113'. [ 543.650854][T25629] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6113'. [ 543.811077][T25237] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 543.941370][T25655] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6119'. [ 543.959256][T25655] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6119'. [ 544.127438][T25668] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6122'. [ 544.267655][T25675] x_tables: duplicate underflow at hook 1 [ 544.335557][T25679] team0: No ports can be present during mode change [ 544.358237][T25679] netlink: 27 bytes leftover after parsing attributes in process `syz.2.6126'. [ 544.381008][T25237] veth0_vlan: entered promiscuous mode [ 544.425356][T25237] veth1_vlan: entered promiscuous mode [ 544.578263][T25690] netlink: 'syz.3.6131': attribute type 13 has an invalid length. [ 544.590836][T25237] veth0_macvtap: entered promiscuous mode [ 544.622817][T25692] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6130'. [ 545.240758][T25690] veth0_macvtap: left promiscuous mode [ 545.251008][T25690] macvtap0: entered allmulticast mode [ 545.296353][T25690] macvtap0: refused to change device tx_queue_len [ 545.363500][T25237] veth1_macvtap: entered promiscuous mode [ 545.371268][T25692] netlink: 'syz.1.6130': attribute type 3 has an invalid length. [ 545.430829][T25696] bond21: Invalid ad_actor_system MAC address. [ 545.437303][T25696] bond21: option ad_actor_system: invalid value (1) [ 545.449643][T25696] bond21 (unregistering): Released all slaves [ 545.535294][T25724] FAULT_INJECTION: forcing a failure. [ 545.535294][T25724] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 545.621897][T25237] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 545.630704][T25724] CPU: 1 UID: 0 PID: 25724 Comm: syz.1.6135 Not tainted syzkaller #0 PREEMPT(full) [ 545.630727][T25724] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 545.630737][T25724] Call Trace: [ 545.630746][T25724] [ 545.630753][T25724] dump_stack_lvl+0xe8/0x150 [ 545.630781][T25724] should_fail_ex+0x412/0x560 [ 545.630812][T25724] _copy_to_user+0x31/0xb0 [ 545.630834][T25724] simple_read_from_buffer+0xe1/0x170 [ 545.630861][T25724] proc_fail_nth_read+0x1bb/0x230 [ 545.630886][T25724] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 545.630911][T25724] ? rw_verify_area+0x2a6/0x4d0 [ 545.630930][T25724] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 545.630957][T25724] vfs_read+0x20c/0xa70 [ 545.630976][T25724] ? fdget_pos+0x246/0x320 [ 545.630997][T25724] ? __pfx___mutex_lock+0x10/0x10 [ 545.631022][T25724] ? __pfx_vfs_read+0x10/0x10 [ 545.631043][T25724] ? __fget_files+0x2a/0x420 [ 545.631073][T25724] ? __fget_files+0x3a0/0x420 [ 545.631099][T25724] ? __fget_files+0x2a/0x420 [ 545.631133][T25724] ksys_read+0x150/0x270 [ 545.631155][T25724] ? __pfx_ksys_read+0x10/0x10 [ 545.631188][T25724] do_syscall_64+0x14d/0xf80 [ 545.631208][T25724] ? trace_irq_disable+0x3b/0x150 [ 545.631225][T25724] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 545.631243][T25724] ? clear_bhb_loop+0x40/0x90 [ 545.631265][T25724] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 545.631282][T25724] RIP: 0033:0x7fa78795d04e [ 545.631297][T25724] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 545.631311][T25724] RSP: 002b:00007fa7888e6fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 545.631331][T25724] RAX: ffffffffffffffda RBX: 00007fa7888e76c0 RCX: 00007fa78795d04e [ 545.631345][T25724] RDX: 000000000000000f RSI: 00007fa7888e70a0 RDI: 0000000000000003 [ 545.631357][T25724] RBP: 00007fa7888e7090 R08: 0000000000000000 R09: 0000000000000000 [ 545.631368][T25724] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 545.631378][T25724] R13: 00007fa787c16038 R14: 00007fa787c15fa0 R15: 00007ffc107f64f8 [ 545.631407][T25724] [ 545.908293][T25237] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 545.923551][T24178] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 545.934626][T24177] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 545.993046][T24177] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 546.060397][T25745] netdevsim netdevsim3 netdevsim0: IPsec offload requires 128 bit authentication [ 546.108136][T24177] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 546.260335][T24178] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 546.275780][T24178] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 546.373194][T25763] netlink: 'syz.0.6147': attribute type 11 has an invalid length. [ 546.407796][T25764] vlan2: entered allmulticast mode [ 546.415947][T25764] bridge1: entered allmulticast mode [ 546.438247][T24182] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 546.447582][T25764] bridge1: port 1(erspan0) entered blocking state [ 546.461029][T25767] xt_hashlimit: size too large, truncated to 1048576 [ 546.468353][T24182] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 546.476626][T25764] bridge1: port 1(erspan0) entered disabled state [ 546.484204][T25764] erspan0: entered allmulticast mode [ 546.492048][T25764] erspan0: entered promiscuous mode [ 546.499917][T25764] bridge1: port 1(erspan0) entered blocking state [ 546.506505][T25764] bridge1: port 1(erspan0) entered forwarding state [ 546.711906][T25775] netlink: 'syz.3.6151': attribute type 1 has an invalid length. [ 547.051115][T25797] __nla_validate_parse: 6 callbacks suppressed [ 547.051137][T25797] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6159'. [ 547.098536][ T51] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 547.111044][ T51] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 547.111182][T25805] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6159'. [ 547.129370][ T51] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 547.150036][ T51] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 547.162259][ T51] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 547.227261][T25801] lo speed is unknown, defaulting to 1000 [ 547.315086][T25797] syzkaller1: entered promiscuous mode [ 547.320652][T25797] syzkaller1: entered allmulticast mode [ 547.525846][T25818] x_tables: duplicate underflow at hook 1 [ 547.667331][T25828] netlink: 40 bytes leftover after parsing attributes in process `syz.0.6167'. [ 547.847868][T25801] chnl_net:caif_netlink_parms(): no params data found [ 548.136947][T25850] syzkaller1: entered promiscuous mode [ 548.143518][T25850] syzkaller1: entered allmulticast mode [ 548.150894][T25801] bridge0: port 1(bridge_slave_0) entered blocking state [ 548.159487][T25801] bridge0: port 1(bridge_slave_0) entered disabled state [ 548.169287][T25801] bridge_slave_0: entered allmulticast mode [ 548.177641][T25801] bridge_slave_0: entered promiscuous mode [ 548.190556][T25801] bridge0: port 2(bridge_slave_1) entered blocking state [ 548.198450][T25801] bridge0: port 2(bridge_slave_1) entered disabled state [ 548.222995][T25801] bridge_slave_1: entered allmulticast mode [ 548.240276][T25801] bridge_slave_1: entered promiscuous mode [ 548.294461][T25857] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6175'. [ 548.310377][T25857] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6175'. [ 548.328191][T25859] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6176'. [ 548.361947][T25801] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 548.401095][T25801] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 548.473400][T25864] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6179'. [ 548.480947][T25801] team0: Port device team_slave_0 added [ 548.489217][T25867] netlink: 6024 bytes leftover after parsing attributes in process `syz.0.6180'. [ 548.509110][T25801] team0: Port device team_slave_1 added [ 548.551454][T25869] bond4: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 548.583228][T25869] bond4: (slave lo): Enslaving as an active interface with an up link [ 548.598774][T25869] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 548.646482][T25801] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 548.661956][T25801] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 548.689255][T25801] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 548.769043][T25801] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 548.778608][T25801] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 548.818682][T25801] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 548.862078][T25885] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6185'. [ 549.028374][T25897] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6189'. [ 549.073313][T25898] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_team, syncid = 4, id = 0 [ 549.113999][T25900] xt_l2tp: missing protocol rule (udp|l2tpip) [ 549.157170][T25801] hsr_slave_0: entered promiscuous mode [ 549.186964][T25801] hsr_slave_1: entered promiscuous mode [ 549.194193][T25801] debugfs: 'hsr0' already exists in 'hsr' [ 549.200030][T25801] Cannot create hsr debugfs directory [ 549.212908][T25905] netlink: 'syz.3.6191': attribute type 1 has an invalid length. [ 549.220812][T25905] netlink: 'syz.3.6191': attribute type 1 has an invalid length. [ 549.235177][ T5827] Bluetooth: hci1: command tx timeout [ 549.243150][T25905] netlink: 'syz.3.6191': attribute type 8 has an invalid length. [ 549.581045][T25929] xt_connbytes: Forcing CT accounting to be enabled [ 549.658801][T25929] xt_CT: No such helper "netbios-ns" [ 549.838302][T25952] gretap1: entered promiscuous mode [ 549.852562][T25952] gretap1: entered allmulticast mode [ 550.014798][T25801] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 550.037005][T25801] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 550.048140][T25801] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 550.060442][T25801] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 550.267566][T25801] 8021q: adding VLAN 0 to HW filter on device bond0 [ 550.324274][T25801] 8021q: adding VLAN 0 to HW filter on device team0 [ 550.353681][T24182] bridge0: port 1(bridge_slave_0) entered blocking state [ 550.360870][T24182] bridge0: port 1(bridge_slave_0) entered forwarding state [ 550.503543][T24176] bridge0: port 2(bridge_slave_1) entered blocking state [ 550.510699][T24176] bridge0: port 2(bridge_slave_1) entered forwarding state [ 551.015642][T25801] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 551.134422][T25801] veth0_vlan: entered promiscuous mode [ 551.168277][T25801] veth1_vlan: entered promiscuous mode [ 551.296928][T25801] veth0_macvtap: entered promiscuous mode [ 551.303358][ T5827] Bluetooth: hci1: command tx timeout [ 551.326565][T25801] veth1_macvtap: entered promiscuous mode [ 551.368352][T25801] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 551.388931][T25801] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 551.435312][T24178] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 551.460546][T24178] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 551.488628][T24178] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 551.493085][T26010] netlink: 'syz.4.6220': attribute type 4 has an invalid length. [ 551.506195][T24178] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 551.693410][T24177] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 551.701268][T24177] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 551.739759][T26017] netlink: 'syz.4.6223': attribute type 1 has an invalid length. [ 551.767746][T24178] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 551.779484][T24178] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 552.108932][T26032] __nla_validate_parse: 10 callbacks suppressed [ 552.108952][T26032] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6227'. [ 552.298136][T26041] netlink: 2 bytes leftover after parsing attributes in process `syz.4.6230'. [ 552.371241][T26051] netlink: 'syz.3.6232': attribute type 1 has an invalid length. [ 552.379198][T26051] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6232'. [ 552.389954][T26051] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6232'. [ 552.404171][T26051] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.6232'. [ 552.654360][T26069] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6240'. [ 552.667941][T26069] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6240'. [ 552.781202][T26074] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6241'. [ 552.975171][T26084] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6245'. [ 553.300070][T26102] netdevsim netdevsim3 netdevsim0: IPsec offload requires 128 bit authentication [ 553.382786][ T5827] Bluetooth: hci1: command tx timeout [ 553.444772][T26105] syzkaller0: entered promiscuous mode [ 553.450415][T26105] syzkaller0: entered allmulticast mode [ 553.454892][T26112] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6253'. [ 555.464861][ T5827] Bluetooth: hci1: command tx timeout [ 556.115888][T26094] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 556.357074][T26141] netlink: 'syz.0.6264': attribute type 2 has an invalid length. [ 556.405210][T26135] geneve2: entered promiscuous mode [ 556.411322][T26135] geneve2: entered allmulticast mode [ 556.531335][T26147] syzkaller1: entered promiscuous mode [ 556.540582][T26147] syzkaller1: entered allmulticast mode [ 556.637749][T26153] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 556.885913][T26166] 8021q: adding VLAN 0 to HW filter on device bond5 [ 556.948794][T26173] tipc: Started in network mode [ 556.953962][T26173] tipc: Node identity daa4566bbeb6, cluster identity 4711 [ 556.977023][T26173] tipc: Enabled bearer , priority 0 [ 557.173501][T26179] syzkaller0: entered promiscuous mode [ 557.179575][T26179] syzkaller0: entered allmulticast mode [ 557.186968][T26179] tipc: Resetting bearer [ 557.266185][T26172] tipc: Resetting bearer [ 557.306751][T26194] __nla_validate_parse: 4 callbacks suppressed [ 557.306769][T26194] netlink: 36 bytes leftover after parsing attributes in process `syz.0.6279'. [ 559.188543][T26172] tipc: Disabling bearer [ 559.217023][ T9789] tipc: Node number set to 1678923371 [ 559.414100][T26213] IPVS: set_ctl: invalid protocol: 108 224.0.0.1:20002 [ 559.432730][T26214] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6286'. [ 559.466986][T26211] bond1: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-xor(2) [ 559.485562][T26211] bond1 (unregistering): Released all slaves [ 560.095047][T26260] tipc: Enabled bearer , priority 0 [ 560.209107][T26260] syzkaller0: entered promiscuous mode [ 560.214879][T26260] syzkaller0: entered allmulticast mode [ 560.220966][T26260] tipc: Resetting bearer [ 560.237945][T26259] tipc: Resetting bearer [ 560.352072][T26272] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6299'. [ 561.723266][T26259] tipc: Disabling bearer [ 561.756419][T26280] netlink: 40 bytes leftover after parsing attributes in process `syz.4.6299'. [ 561.784724][T21450] tipc: Node number set to 2358499440 [ 561.834150][T26286] netlink: 'syz.2.6303': attribute type 1 has an invalid length. [ 561.842032][T26286] netlink: 228 bytes leftover after parsing attributes in process `syz.2.6303'. [ 561.937427][T26294] netlink: 'syz.0.6305': attribute type 16 has an invalid length. [ 562.005170][T26304] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6308'. [ 562.166824][T26316] netlink: 'syz.0.6311': attribute type 15 has an invalid length. [ 562.231739][T26318] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6312'. [ 562.254586][T26318] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6312'. [ 562.412836][T26323] tipc: Started in network mode [ 562.417987][T26323] tipc: Node identity c2832baf6b73, cluster identity 4711 [ 562.427804][T26323] tipc: Enabled bearer , priority 0 [ 562.526650][T26323] syzkaller0: entered promiscuous mode [ 562.541504][T26323] syzkaller0: entered allmulticast mode [ 562.571419][T26323] tipc: Resetting bearer [ 562.607187][T26333] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 562.616732][T26322] tipc: Resetting bearer [ 562.910970][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.927540][ T1300] lec:lec_start_xmit: lec0:No lecd attached [ 563.229073][T26360] netlink: 44 bytes leftover after parsing attributes in process `syz.3.6326'. [ 563.253261][T26360] netlink: 43 bytes leftover after parsing attributes in process `syz.3.6326'. [ 563.264097][T26360] netlink: 'syz.3.6326': attribute type 6 has an invalid length. [ 563.271858][T26360] netlink: 'syz.3.6326': attribute type 5 has an invalid length. [ 563.280226][T26360] netlink: 43 bytes leftover after parsing attributes in process `syz.3.6326'. [ 563.298403][T26360] TCP: TCP_TX_DELAY enabled [ 564.290392][T26322] tipc: Disabling bearer [ 564.323823][T21450] tipc: Node number set to 2851089327 [ 564.580959][T26378] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6332'. [ 564.629182][T26378] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6332'. [ 564.668483][T26371] syzkaller0: entered promiscuous mode [ 564.682717][T26371] syzkaller0: entered allmulticast mode [ 564.745837][T26378] bridge0: port 1(bridge_slave_0) entered disabled state [ 564.814516][T26378] bridge_slave_0 (unregistering): left allmulticast mode [ 564.851836][T26378] bridge_slave_0 (unregistering): left promiscuous mode [ 564.866369][T26378] bridge0: port 1(bridge_slave_0) entered disabled state [ 564.884343][T26395] netlink: 256 bytes leftover after parsing attributes in process `syz.2.6333'. [ 566.524450][T26406] xt_hashlimit: size too large, truncated to 1048576 [ 566.559550][T26408] tipc: Enabled bearer , priority 10 [ 566.693835][T26408] syzkaller0: entered promiscuous mode [ 566.699545][T26408] syzkaller0: entered allmulticast mode [ 566.706530][T26408] tipc: Resetting bearer [ 566.725040][T26413] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 566.747577][T26413] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 566.847664][T26427] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6343'. [ 566.869314][T26427] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6343'. [ 566.883405][T26413] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 566.893710][T26427] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6343'. [ 566.895296][T26413] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 566.968506][T26407] tipc: Resetting bearer [ 567.167259][T26444] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 567.178340][T26445] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 567.943572][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 567.951614][ C0] lec:lec_tx_timeout: lec0 [ 568.531599][T26407] tipc: Disabling bearer [ 568.547332][T26427] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6343'. [ 568.556846][T26427] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6343'. [ 568.566332][T26427] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6343'. [ 568.597613][T24179] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 568.618750][T24179] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 568.637237][T24179] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 568.678381][T24179] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 568.980305][T26483] bond4: option mode: unable to set because the bond device has slaves [ 569.051945][T26484] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 569.069299][T26483] bond4: option mode: unable to set because the bond device has slaves [ 569.154676][T26484] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 569.170634][T26484] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 569.186579][T26483] bond4: option mode: unable to set because the bond device has slaves [ 569.299165][T26484] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 569.342884][T26484] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 569.359240][T26484] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 569.388168][T26483] bond4: option mode: unable to set because the bond device has slaves [ 569.450119][T26484] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 569.472927][T26484] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 569.491189][T26502] netlink: 116 bytes leftover after parsing attributes in process `syz.0.6364'. [ 569.510843][T26502] netlink: 116 bytes leftover after parsing attributes in process `syz.0.6364'. [ 569.530557][T26483] bond4: option mode: unable to set because the bond device has slaves [ 569.590476][T26484] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 569.628181][T26484] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 569.666799][T26483] bond4: option mode: unable to set because the bond device has slaves [ 569.700162][T26508] bond1: option mode: invalid value (133) [ 569.719235][T26508] bond1 (unregistering): Released all slaves [ 569.722214][T26496] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6362'. [ 569.737543][T26496] netlink: 7 bytes leftover after parsing attributes in process `syz.3.6362'. [ 569.759604][T26483] bond4: option mode: unable to set because the bond device has slaves [ 569.770459][T26483] bond4: option mode: unable to set because the bond device has slaves [ 569.967662][T26523] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6371'. [ 569.977039][ T7998] lec:lec_start_xmit: lec0:No lecd attached [ 570.006184][T26523] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6371'. [ 570.598329][T26568] netlink: 212304 bytes leftover after parsing attributes in process `syz.2.6383'. [ 571.173626][T26596] netlink: 'syz.0.6391': attribute type 4 has an invalid length. [ 571.229256][T26596] netlink: 'syz.0.6391': attribute type 4 has an invalid length. [ 571.269057][T26596] syzkaller0: entered promiscuous mode [ 571.274913][T26596] syzkaller0: entered allmulticast mode [ 571.351444][T26605] netlink: 'syz.3.6396': attribute type 4 has an invalid length. [ 571.389265][T26605] netlink: 'syz.3.6396': attribute type 4 has an invalid length. [ 571.848184][T26642] syzkaller0: entered promiscuous mode [ 571.870682][T26642] syzkaller0: entered allmulticast mode [ 571.888086][T26646] netdevsim netdevsim4: Firmware load for '..' refused, path contains '..' component [ 571.906814][T26646] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 572.005807][ T120] IPVS: starting estimator thread 0... [ 572.048200][T26655] batadv_slave_0: entered promiscuous mode [ 572.091914][T26654] batadv_slave_0: left promiscuous mode [ 572.102665][T26656] IPVS: using max 31 ests per chain, 74400 per kthread [ 572.208989][T26667] syzkaller0: entered promiscuous mode [ 572.220395][T26667] syzkaller0: entered allmulticast mode [ 572.368494][T26664] batadv1: entered allmulticast mode [ 572.548450][T26688] tipc: Enabling of bearer rejected, failed to enable media [ 572.708446][T26697] erspan0: entered promiscuous mode [ 572.747586][T26697] gretap0: entered promiscuous mode [ 572.774902][T26697] debugfs: 'hsr1' already exists in 'hsr' [ 572.795419][T26697] Cannot create hsr debugfs directory [ 572.872639][T26697] ieee802154 phy0 wpan0: encryption failed: -22 [ 573.127957][T26714] pim6reg1: entered promiscuous mode [ 573.173077][T26714] pim6reg1: entered allmulticast mode [ 573.210642][T26712] netem: unknown loss type 0 [ 573.226652][T26712] netem: change failed [ 573.966438][T26765] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 574.206711][T26784] __nla_validate_parse: 5 callbacks suppressed [ 574.206729][T26784] netlink: 64 bytes leftover after parsing attributes in process `syz.4.6450'. [ 574.328287][T26793] lo speed is unknown, defaulting to 1000 [ 574.353236][ T9779] IPVS: starting estimator thread 0... [ 574.442660][T26797] IPVS: using max 35 ests per chain, 84000 per kthread [ 574.476102][T26808] netlink: 'syz.0.6454': attribute type 1 has an invalid length. [ 574.531739][T26812] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6454'. [ 574.556196][ T9774] IPVS: starting estimator thread 0... [ 574.561985][T26809] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 574.672456][T26813] IPVS: using max 37 ests per chain, 88800 per kthread [ 574.796196][T26821] netlink: 'syz.3.6460': attribute type 2 has an invalid length. [ 574.816857][T26820] netlink: 'syz.3.6460': attribute type 2 has an invalid length. [ 574.851438][T26829] netlink: 'syz.4.6461': attribute type 2 has an invalid length. [ 574.878663][T26829] netlink: 119 bytes leftover after parsing attributes in process `syz.4.6461'. [ 574.928579][T26834] netlink: 6024 bytes leftover after parsing attributes in process `syz.3.6463'. [ 574.987263][T26831] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6461'. [ 574.996401][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 574.996433][ C0] lec:lec_tx_timeout: lec0 [ 575.350348][T26844] netlink: 1232 bytes leftover after parsing attributes in process `syz.3.6468'. [ 575.372794][T26846] netdevsim netdevsim2 netdevsim0: IPsec offload requires 128 bit authentication [ 575.388105][T26844] net_ratelimit: 12 callbacks suppressed [ 575.388122][T26844] openvswitch: netlink: Flow key attr not present in new flow. [ 575.540242][ T51] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 575.554202][ T51] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 575.562740][ T51] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 575.570785][ T51] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 575.580333][ T51] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 575.708991][T26853] lo speed is unknown, defaulting to 1000 [ 575.783312][T26862] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 575.898720][T26868] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6478'. [ 575.899735][T26867] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.6479'. [ 575.950211][T15870] syz_tun (unregistering): left allmulticast mode [ 575.964500][T15870] syz_tun (unregistering): left promiscuous mode [ 575.981168][T15870] bridge0: port 3(syz_tun) entered disabled state [ 576.275396][T26891] netlink: 212348 bytes leftover after parsing attributes in process `syz.4.6488'. [ 576.310065][T26890] netlink: 'syz.2.6487': attribute type 15 has an invalid length. [ 576.313301][T26891] netlink: ct family unspecified [ 576.320104][T26890] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6487'. [ 576.499091][T26897] lo speed is unknown, defaulting to 1000 [ 576.690437][T26853] chnl_net:caif_netlink_parms(): no params data found [ 576.848890][T26918] xt_hashlimit: size too large, truncated to 1048576 [ 576.947086][T26928] netlink: 'syz.3.6499': attribute type 5 has an invalid length. [ 577.010802][T26920] syzkaller0: entered promiscuous mode [ 577.016591][T26920] syzkaller0: entered allmulticast mode [ 577.034793][T26853] bridge0: port 1(bridge_slave_0) entered blocking state [ 577.042292][T26853] bridge0: port 1(bridge_slave_0) entered disabled state [ 577.052450][T26853] bridge_slave_0: entered allmulticast mode [ 577.060743][T26853] bridge_slave_0: entered promiscuous mode [ 577.085558][T26853] bridge0: port 2(bridge_slave_1) entered blocking state [ 577.102036][T26853] bridge0: port 2(bridge_slave_1) entered disabled state [ 577.122984][T26853] bridge_slave_1: entered allmulticast mode [ 577.130814][T26853] bridge_slave_1: entered promiscuous mode [ 577.269026][T26853] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 577.331697][T26853] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 577.488761][T26853] team0: Port device team_slave_0 added [ 577.529494][T26853] team0: Port device team_slave_1 added [ 577.547383][T26944] €Â: renamed from vlan0 (while UP) [ 577.625255][ T5827] Bluetooth: hci2: command tx timeout [ 577.747535][T26853] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 577.757429][T26853] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 577.788395][T26853] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 577.823862][T26853] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 577.837104][T26853] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 577.865130][T26853] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 577.941760][T26853] hsr_slave_0: entered promiscuous mode [ 577.955292][T26853] hsr_slave_1: entered promiscuous mode [ 577.966725][T26853] debugfs: 'hsr0' already exists in 'hsr' [ 577.974222][T26853] Cannot create hsr debugfs directory [ 578.172172][T26973] netlink: 'syz.0.6515': attribute type 23 has an invalid length. [ 578.294501][T26853] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 578.339391][T26975] team0: Port device team_slave_0 removed [ 578.368589][T26979] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 578.377954][T26979] team0: Failed to send port change of device batadv1 via netlink (err -105) [ 578.389619][T26979] team0: Failed to send options change via netlink (err -105) [ 578.398653][T26981] netlink: 'syz.3.6518': attribute type 1 has an invalid length. [ 578.407978][T26979] team0: Port device batadv1 added [ 578.460899][T26853] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 578.609758][T26853] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 578.638543][T26992] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 578.795429][T26853] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 579.157661][T27027] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 579.161913][T26853] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 579.177999][T26853] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 579.193335][T26853] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 579.218869][T26853] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 579.255217][T27034] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 579.286912][T27034] netlink: 'syz.2.6536': attribute type 21 has an invalid length. [ 579.489390][T26853] 8021q: adding VLAN 0 to HW filter on device bond0 [ 579.559106][T26853] 8021q: adding VLAN 0 to HW filter on device team0 [ 579.567694][T27054] lo speed is unknown, defaulting to 1000 [ 579.592391][T24179] bridge0: port 1(bridge_slave_0) entered blocking state [ 579.599679][T24179] bridge0: port 1(bridge_slave_0) entered forwarding state [ 579.629776][T24179] bridge0: port 2(bridge_slave_1) entered blocking state [ 579.636982][T24179] bridge0: port 2(bridge_slave_1) entered forwarding state [ 579.696679][T27060] ip6tnl0: Caught tx_queue_len zero misconfig [ 579.704344][ T5827] Bluetooth: hci2: command tx timeout [ 579.744050][T27063] __nla_validate_parse: 12 callbacks suppressed [ 579.744066][T27063] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6545'. [ 579.761493][T27060] sctp: [Deprecated]: syz.3.6544 (pid 27060) Use of struct sctp_assoc_value in delayed_ack socket option. [ 579.761493][T27060] Use struct sctp_sack_info instead [ 579.793048][T27060] sctp: [Deprecated]: syz.3.6544 (pid 27060) Use of struct sctp_assoc_value in delayed_ack socket option. [ 579.793048][T27060] Use struct sctp_sack_info instead [ 579.837190][T27063] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 580.126137][T27080] netlink: 48 bytes leftover after parsing attributes in process `syz.2.6549'. [ 580.233389][T27091] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6549'. [ 580.372529][T26853] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 580.619501][T26853] veth0_vlan: entered promiscuous mode [ 580.750530][T26853] veth1_vlan: entered promiscuous mode [ 580.909842][T26853] veth0_macvtap: entered promiscuous mode [ 580.927916][T26853] veth1_macvtap: entered promiscuous mode [ 580.990213][T26853] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 581.002129][T27124] SET target dimension over the limit! [ 581.030631][T26853] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 581.047952][T27125] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6563'. [ 581.056637][T24174] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.059181][T27129] nbd: couldn't find a device at index 0 [ 581.075059][T27129] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6566'. [ 581.081643][T24174] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.099405][T27131] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6563'. [ 581.125166][T24174] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.130903][T27124] netlink: 'syz.2.6564': attribute type 2 has an invalid length. [ 581.164706][T27124] netlink: 244 bytes leftover after parsing attributes in process `syz.2.6564'. [ 581.190068][T24174] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.423281][T27156] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6572'. [ 581.484014][T24178] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 581.500613][T24178] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 581.685466][T27169] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6575'. [ 581.745905][T24178] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 581.754959][T24180] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 581.758571][T24178] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 581.770831][T24180] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 581.794895][ T5827] Bluetooth: hci2: command tx timeout [ 581.825720][T27169] 8021q: adding VLAN 0 to HW filter on device bond1 [ 581.892238][T24182] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 581.916649][T24182] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 582.157170][T27184] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6579'. [ 582.395388][T27188] syzkaller0: entered allmulticast mode [ 582.531645][T27188] veth3: entered allmulticast mode [ 582.557333][T27188] bond1: (slave veth3): Enslaving as an active interface with an up link [ 583.688892][T27244] netlink: 'syz.4.6599': attribute type 13 has an invalid length. [ 583.708567][T27244] gretap0: refused to change device tx_queue_len [ 583.716011][T27244] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 583.817312][T27248] bond0: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 583.831759][T27248] bond0: (slave lo): Error: Device can not be enslaved while up [ 583.873616][ T5827] Bluetooth: hci2: command tx timeout [ 583.882542][T27249] bond0: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 583.905257][T27249] bond0: (slave lo): Error: Device can not be enslaved while up [ 583.925660][T27251] syzkaller0: entered allmulticast mode [ 583.950769][T27251] syzkaller0 (unregistering): left allmulticast mode [ 584.543178][T27270] netlink: 'syz.3.6607': attribute type 4 has an invalid length. [ 584.569813][T27270] .`: renamed from bond0 (while UP) [ 584.785024][T27285] nbd: must specify at least one socket [ 584.859577][T27285] __nla_validate_parse: 7 callbacks suppressed [ 584.859596][T27285] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6612'. [ 585.615330][T27325] netlink: 348 bytes leftover after parsing attributes in process `syz.0.6624'. [ 585.760680][T27316] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 585.778030][T27328] netlink: 'syz.0.6624': attribute type 12 has an invalid length. [ 585.923151][T27334] nbd: must specify at least one socket [ 586.040593][T27334] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6626'. [ 586.157793][T27345] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6629'. [ 586.227495][T27350] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6630'. [ 586.266089][T27350] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6630'. [ 586.320194][T27353] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6632'. [ 586.654175][T27367] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6637'. [ 586.883879][T27380] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6640'. [ 586.893222][T27380] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6640'. [ 586.944729][T27387] netdevsim netdevsim4 netdevsim0: IPsec offload requires 128 bit authentication [ 587.337564][ T9774] IPVS: starting estimator thread 0... [ 587.340887][T27413] netlink: ct family unspecified [ 587.442510][T27412] IPVS: using max 32 ests per chain, 76800 per kthread [ 587.514105][T27425] netdevsim netdevsim2 netdevsim0: IPsec offload requires 128 bit authentication [ 587.669556][T27430] netlink: 'syz.1.6656': attribute type 1 has an invalid length. [ 588.123155][T27463] syz_tun: entered allmulticast mode [ 588.226312][T27444] syz_tun: left allmulticast mode [ 588.429483][T27480] veth1_to_bond: entered allmulticast mode [ 588.477708][T27487] veth1_to_bond: left allmulticast mode [ 588.589668][T27495] openvswitch: netlink: Flow actions attr not present in new flow. [ 588.700581][T27502] netlink: 'syz.1.6676': attribute type 22 has an invalid length. [ 588.723256][T27502] netlink: 'syz.1.6676': attribute type 22 has an invalid length. [ 588.751130][T27507] netlink: 'syz.3.6677': attribute type 1 has an invalid length. [ 588.821805][T27507] 8021q: adding VLAN 0 to HW filter on device bond0 [ 588.958794][T27507] 8021q: adding VLAN 0 to HW filter on device bond2 [ 588.977423][T27507] bond0: (slave bond2): Enslaving as an active interface with a down link [ 589.327916][T27538] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 589.957570][T27577] netlink: 'syz.0.6699': attribute type 13 has an invalid length. [ 590.120790][T27583] netlink: 'syz.2.6700': attribute type 4 has an invalid length. [ 590.160288][T27585] __nla_validate_parse: 16 callbacks suppressed [ 590.160306][T27585] netlink: 16186 bytes leftover after parsing attributes in process `syz.4.6704'. [ 590.226669][T27598] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6705'. [ 590.289976][T27601] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6706'. [ 590.311244][T27601] openvswitch: netlink: IPv4 frag type 127 is out of range max 2 [ 590.324519][T27603] netlink: 'syz.2.6709': attribute type 1 has an invalid length. [ 590.335225][T27598] vlan3: entered allmulticast mode [ 590.340482][T27598] bridge3: entered allmulticast mode [ 590.398660][T27603] bond1: entered promiscuous mode [ 590.406287][T27603] 8021q: adding VLAN 0 to HW filter on device bond1 [ 590.480117][T27613] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6710'. [ 590.499034][T27613] netlink: 'syz.4.6710': attribute type 5 has an invalid length. [ 590.510414][T27613] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6710'. [ 590.527814][T27619] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6710'. [ 590.537424][T27619] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6710'. [ 590.592275][T27623] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6714'. [ 590.619305][T27619] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6710'. [ 590.643626][T27619] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6710'. [ 590.717872][T27629] lo: Caught tx_queue_len zero misconfig [ 590.853993][T27634] openvswitch: netlink: Tunnel attr 47 out of range max 16 [ 590.990837][T27649] SET target dimension over the limit! [ 590.998252][T27649] netlink: 'syz.3.6724': attribute type 8 has an invalid length. [ 591.089679][T27652] x_tables: duplicate underflow at hook 2 [ 591.195642][T27660] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'syz0' [ 591.245292][T27660] netlink: 'syz.1.6728': attribute type 21 has an invalid length. [ 591.270710][T24178] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 591.757272][T27695] netlink: 'syz.2.6740': attribute type 1 has an invalid length. [ 591.848017][T27695] 8021q: adding VLAN 0 to HW filter on device bond2 [ 592.097784][T27723] bond0: Caught tx_queue_len zero misconfig [ 592.328815][T27736] syzkaller0: entered promiscuous mode [ 592.336646][T27736] syzkaller0: entered allmulticast mode [ 592.368949][T27744] vlan2: entered allmulticast mode [ 592.375215][T27744] bridge2: entered allmulticast mode [ 592.418113][T27744] bridge2: port 1(erspan0) entered blocking state [ 592.425362][T27744] bridge2: port 1(erspan0) entered disabled state [ 592.432104][T27744] erspan0: entered allmulticast mode [ 592.439341][T27744] erspan0: entered promiscuous mode [ 592.448752][T27744] bridge2: port 1(erspan0) entered blocking state [ 592.455423][T27744] bridge2: port 1(erspan0) entered forwarding state [ 592.470920][T27746] macvlan0: entered promiscuous mode [ 592.999509][T27777] gtp0: entered promiscuous mode [ 593.012613][T27777] gtp0: entered allmulticast mode [ 593.096669][T27785] vxcan1: mtu less than device minimum [ 593.326656][T27800] wireguard0: entered promiscuous mode [ 593.332181][T27800] wireguard0: entered allmulticast mode [ 593.390335][T27800] team0: Device wireguard0 is of different type [ 593.503230][T27821] netdevsim netdevsim0 netdevsim0: IPsec offload requires 128 bit authentication [ 593.605952][T27823] IPv6: addrconf: prefix option has invalid lifetime [ 593.899988][T27847] geneve2: entered promiscuous mode [ 593.912590][T27847] geneve2: entered allmulticast mode [ 594.070125][T27862] netdevsim netdevsim3 netdevsim0: IPsec offload requires 128 bit authentication [ 594.337480][T27877] syzkaller0: entered promiscuous mode [ 594.343197][T27877] syzkaller0: entered allmulticast mode [ 594.538191][T27894] xt_TPROXY: Can be used only with -p tcp or -p udp [ 594.877154][T27915] x_tables: unsorted entry at hook 3 [ 594.943487][T27922] wireguard0: entered promiscuous mode [ 594.949010][T27922] wireguard0: entered allmulticast mode [ 595.005337][T27922] team0: Device wireguard0 is of different type [ 595.283240][T27948] __nla_validate_parse: 24 callbacks suppressed [ 595.283258][T27948] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6820'. [ 595.771568][T27982] netlink: 'syz.4.6826': attribute type 1 has an invalid length. [ 595.843316][T27982] 8021q: adding VLAN 0 to HW filter on device bond2 [ 596.162267][T28006] mpoa:mpoad_close: (lec0) going down [ 596.266087][T28012] netlink: 'syz.0.6836': attribute type 1 has an invalid length. [ 596.434815][T28022] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6840'. [ 596.509939][T28022] vlan2: entered allmulticast mode [ 596.521063][T28022] bridge5: entered allmulticast mode [ 596.537225][T28022] bridge5: port 1(erspan0) entered blocking state [ 596.546090][T28022] bridge5: port 1(erspan0) entered disabled state [ 596.557105][T28022] erspan0: entered allmulticast mode [ 596.564960][T28022] erspan0: entered promiscuous mode [ 596.571406][T28022] bridge5: port 1(erspan0) entered blocking state [ 596.578007][T28022] bridge5: port 1(erspan0) entered forwarding state [ 596.611818][T28035] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6845'. [ 596.713975][T28045] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6847'. [ 596.742095][T28047] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6848'. [ 596.895486][T28056] netlink: 72 bytes leftover after parsing attributes in process `syz.3.6851'. [ 597.372513][T28077] xt_hashlimit: size too large, truncated to 1048576 [ 597.404441][T28077] tipc: Enabling of bearer rejected, media not registered [ 597.532035][T28088] netdevsim netdevsim0 netdevsim0: IPsec offload requires 128 bit authentication [ 597.545176][T28077] bond3: entered promiscuous mode [ 597.750726][T28095] pim6reg: entered allmulticast mode [ 597.776666][T28098] FAULT_INJECTION: forcing a failure. [ 597.776666][T28098] name failslab, interval 1, probability 0, space 0, times 0 [ 597.802960][T28098] CPU: 1 UID: 0 PID: 28098 Comm: syz.4.6864 Not tainted syzkaller #0 PREEMPT(full) [ 597.802984][T28098] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 597.802995][T28098] Call Trace: [ 597.803003][T28098] [ 597.803011][T28098] dump_stack_lvl+0xe8/0x150 [ 597.803042][T28098] should_fail_ex+0x412/0x560 [ 597.803072][T28098] should_failslab+0xa8/0x100 [ 597.803095][T28098] ? dst_alloc+0x105/0x170 [ 597.803118][T28098] kmem_cache_alloc_noprof+0x87/0x650 [ 597.803146][T28098] dst_alloc+0x105/0x170 [ 597.803167][T28098] ? ip_check_mc_rcu+0x4c7/0x680 [ 597.803199][T28098] ip_route_output_key_hash_rcu+0x14d0/0x25d0 [ 597.803236][T28098] ? ip_route_output_key_hash+0xd8/0x2a0 [ 597.803259][T28098] ip_route_output_key_hash+0x18d/0x2a0 [ 597.803283][T28098] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 597.803321][T28098] ip_route_output_flow+0x2a/0x150 [ 597.803355][T28098] ? security_sk_classify_flow+0x6d/0x150 [ 597.803380][T28098] udp_sendmsg+0x154a/0x22f0 [ 597.803403][T28098] ? count_memcg_event_mm+0x21/0x260 [ 597.803443][T28098] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 597.803466][T28098] ? __pfx_udp_sendmsg+0x10/0x10 [ 597.803514][T28098] ? __pfx_aa_sk_perm+0x10/0x10 [ 597.803533][T28098] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 597.803561][T28098] ? sock_rps_record_flow+0x19/0x400 [ 597.803583][T28098] ? inet_sendmsg+0x29c/0x370 [ 597.803602][T28098] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 597.803624][T28098] ____sys_sendmsg+0x80a/0x9f0 [ 597.803645][T28098] ? irqentry_exit+0x59e/0x620 [ 597.803665][T28098] ? trace_irq_disable+0x3b/0x150 [ 597.803687][T28098] ? __pfx_____sys_sendmsg+0x10/0x10 [ 597.803725][T28098] ? import_iovec+0x73/0xa0 [ 597.803747][T28098] ___sys_sendmsg+0x2a5/0x360 [ 597.803771][T28098] ? __pfx____sys_sendmsg+0x10/0x10 [ 597.803807][T28098] ? lockdep_hardirqs_on+0x7a/0x110 [ 597.803846][T28098] __sys_sendmmsg+0x27c/0x4e0 [ 597.803871][T28098] ? __pfx___sys_sendmmsg+0x10/0x10 [ 597.803894][T28098] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 597.803939][T28098] ? ksys_write+0x242/0x270 [ 597.803962][T28098] ? __pfx_ksys_write+0x10/0x10 [ 597.803988][T28098] __x64_sys_sendmmsg+0xa0/0xc0 [ 597.804012][T28098] do_syscall_64+0x14d/0xf80 [ 597.804032][T28098] ? trace_irq_disable+0x3b/0x150 [ 597.804046][T28098] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 597.804063][T28098] ? clear_bhb_loop+0x40/0x90 [ 597.804085][T28098] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 597.804102][T28098] RIP: 0033:0x7f06b319c819 [ 597.804127][T28098] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 597.804143][T28098] RSP: 002b:00007f06b3fd9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 597.804164][T28098] RAX: ffffffffffffffda RBX: 00007f06b3415fa0 RCX: 00007f06b319c819 [ 597.804178][T28098] RDX: 000000000800001d RSI: 0000200000007fc0 RDI: 0000000000000003 [ 597.804190][T28098] RBP: 00007f06b3fd9090 R08: 0000000000000000 R09: 0000000000000000 [ 597.804202][T28098] R10: 000000000000001c R11: 0000000000000246 R12: 0000000000000001 [ 597.804213][T28098] R13: 00007f06b3416038 R14: 00007f06b3415fa0 R15: 00007ffe877188f8 [ 597.804244][T28098] [ 598.158414][T28096] netlink: 'syz.0.6863': attribute type 39 has an invalid length. [ 598.361397][T28107] nbd: must specify a size in bytes for the device [ 598.566912][T28109] netlink: 'syz.3.6868': attribute type 1 has an invalid length. [ 598.582403][T28109] netlink: 'syz.3.6868': attribute type 4 has an invalid length. [ 598.618843][T28109] netlink: 9462 bytes leftover after parsing attributes in process `syz.3.6868'. [ 598.749759][T28125] netdevsim netdevsim2 netdevsim0: IPsec offload requires 128 bit authentication [ 598.932846][T28133] bond0: Caught tx_queue_len zero misconfig [ 599.025946][T28139] netlink: 'syz.1.6880': attribute type 1 has an invalid length. [ 599.046012][T28139] netlink: 'syz.1.6880': attribute type 2 has an invalid length. [ 599.089988][T28139] netlink: 'syz.1.6880': attribute type 1 has an invalid length. [ 599.112539][T28139] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6880'. [ 599.184825][T28148] ip6tnl0: Caught tx_queue_len zero misconfig [ 599.314882][T28162] ------------[ cut here ]------------ [ 599.320414][T28162] refcount_t: decrement hit 0; leaking memory. [ 599.326732][T28162] WARNING: lib/refcount.c:31 at refcount_warn_saturate+0x70/0x110, CPU#1: syz.3.6875/28162 [ 599.337009][T28162] Modules linked in: [ 599.341374][T28162] CPU: 1 UID: 0 PID: 28162 Comm: syz.3.6875 Not tainted syzkaller #0 PREEMPT(full) [ 599.350917][T28162] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 599.361562][T28162] RIP: 0010:refcount_warn_saturate+0x70/0x110 [ 599.367764][T28162] Code: c6 c0 24 f0 8e e8 e0 7c 16 fd 83 fb 01 7e 22 83 fb 02 74 39 83 fb 03 74 47 83 fb 04 75 68 e8 47 77 16 fd 48 8d 3d 50 47 6d 0b <67> 48 0f b9 3a eb 66 85 db 74 3e 83 fb 01 75 4c e8 2b 77 16 fd 48 [ 599.388623][T28162] RSP: 0018:ffffc9000bfa7b48 EFLAGS: 00010283 [ 599.395000][T28162] RAX: ffffffff84af3729 RBX: 0000000000000004 RCX: 0000000000080000 [ 599.404044][T28162] RDX: ffffc9000ed8a000 RSI: 0000000000000037 RDI: ffffffff901c7e80 [ 599.412405][T28162] RBP: ffffc9000bfa7ca0 R08: ffff88807e0f0000 R09: 0000000000000005 [ 599.412899][T28161] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6889'. [ 599.420416][T28162] R10: 0000000000000004 R11: 0000000000000002 R12: f8f8f8f8f8f8f8f8 [ 599.420463][T28162] R13: dffffc0000000000 R14: ffff888054d4c668 R15: 0000000000000001 [ 599.420478][T28162] FS: 00007f27863b46c0(0000) GS:ffff888125559000(0000) knlGS:0000000000000000 [ 599.420496][T28162] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 599.420511][T28162] CR2: 000000110c34e51c CR3: 000000003f0a0000 CR4: 00000000003526f0 [ 599.420530][T28162] Call Trace: [ 599.472943][T28162] [ 599.475896][T28162] ref_tracker_free+0x6fc/0x840 [ 599.477432][T28167] syzkaller1: entered promiscuous mode [ 599.480867][T28162] ? __pfx_ref_tracker_free+0x10/0x10 [ 599.491779][T28167] syzkaller1: entered allmulticast mode [ 599.497448][T28162] ? __pfx_locks_remove_file+0x10/0x10 [ 599.497477][T28162] ? ima_file_free+0x170/0x4e0 [ 599.497504][T28162] ? do_raw_spin_lock+0x12b/0x2f0 [ 599.497527][T28162] ? lock_acquire+0xf0/0x2e0 [ 599.497562][T28162] ? vcc_release+0x54/0x580 [ 599.497587][T28162] mpoad_close+0x1fc/0x3e0 [ 599.526553][T28162] ? __pfx_mpoad_close+0x10/0x10 [ 599.531517][T28162] vcc_release+0x10f/0x580 [ 599.536017][T28162] sock_close+0xc3/0x240 [ 599.540328][T28162] ? __pfx_sock_close+0x10/0x10 [ 599.546529][T28162] __fput+0x44f/0xa70 [ 599.550563][T28162] fput_close_sync+0x11f/0x240 [ 599.555652][T28162] ? __pfx_fput_close_sync+0x10/0x10 [ 599.560949][T28162] __x64_sys_close+0x7e/0x110 [ 599.565718][T28162] do_syscall_64+0x14d/0xf80 [ 599.570322][T28162] ? trace_irq_disable+0x3b/0x150 [ 599.575427][T28162] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 599.581505][T28162] ? clear_bhb_loop+0x40/0x90 [ 599.586261][T28162] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 599.592174][T28162] RIP: 0033:0x7f278819c819 [ 599.596740][T28162] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 599.616497][T28162] RSP: 002b:00007f27863b4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 599.625244][T28162] RAX: ffffffffffffffda RBX: 00007f2788416180 RCX: 00007f278819c819 [ 599.633556][T28162] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 599.641550][T28162] RBP: 00007f2788232c91 R08: 0000000000000000 R09: 0000000000000000 [ 599.649637][T28162] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 599.657780][T28162] R13: 00007f2788416218 R14: 00007f2788416180 R15: 00007fff26b31ac8 [ 599.666108][T28162] [ 599.669171][T28162] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 599.676457][T28162] CPU: 1 UID: 0 PID: 28162 Comm: syz.3.6875 Not tainted syzkaller #0 PREEMPT(full) [ 599.685809][T28162] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 599.695866][T28162] Call Trace: [ 599.699138][T28162] [ 599.702065][T28162] vpanic+0x56c/0xa60 [ 599.706073][T28162] ? __pfx__printk+0x10/0x10 [ 599.710681][T28162] ? __pfx_vpanic+0x10/0x10 [ 599.715216][T28162] ? is_bpf_text_address+0x292/0x2b0 [ 599.720510][T28162] ? is_bpf_text_address+0x26/0x2b0 [ 599.725727][T28162] panic+0xc5/0xd0 [ 599.729444][T28162] ? __pfx_panic+0x10/0x10 [ 599.733872][T28162] __warn+0x315/0x4f0 [ 599.737854][T28162] ? refcount_warn_saturate+0x70/0x110 [ 599.743328][T28162] ? refcount_warn_saturate+0x70/0x110 [ 599.748785][T28162] __report_bug+0x29a/0x540 [ 599.753297][T28162] ? stack_depot_save_flags+0x33/0x810 [ 599.758844][T28162] ? refcount_warn_saturate+0x70/0x110 [ 599.764306][T28162] ? __pfx___report_bug+0x10/0x10 [ 599.769333][T28162] ? kasan_save_free_info+0x46/0x50 [ 599.774547][T28162] report_bug_entry+0x19a/0x290 [ 599.779400][T28162] ? refcount_warn_saturate+0x70/0x110 [ 599.784877][T28162] ? refcount_warn_saturate+0x75/0x110 [ 599.790331][T28162] handle_bug+0xce/0x200 [ 599.794587][T28162] exc_invalid_op+0x1a/0x50 [ 599.799116][T28162] asm_exc_invalid_op+0x1a/0x20 [ 599.803974][T28162] RIP: 0010:refcount_warn_saturate+0x70/0x110 [ 599.810038][T28162] Code: c6 c0 24 f0 8e e8 e0 7c 16 fd 83 fb 01 7e 22 83 fb 02 74 39 83 fb 03 74 47 83 fb 04 75 68 e8 47 77 16 fd 48 8d 3d 50 47 6d 0b <67> 48 0f b9 3a eb 66 85 db 74 3e 83 fb 01 75 4c e8 2b 77 16 fd 48 [ 599.829739][T28162] RSP: 0018:ffffc9000bfa7b48 EFLAGS: 00010283 [ 599.835806][T28162] RAX: ffffffff84af3729 RBX: 0000000000000004 RCX: 0000000000080000 [ 599.843770][T28162] RDX: ffffc9000ed8a000 RSI: 0000000000000037 RDI: ffffffff901c7e80 [ 599.851759][T28162] RBP: ffffc9000bfa7ca0 R08: ffff88807e0f0000 R09: 0000000000000005 [ 599.859723][T28162] R10: 0000000000000004 R11: 0000000000000002 R12: f8f8f8f8f8f8f8f8 [ 599.867774][T28162] R13: dffffc0000000000 R14: ffff888054d4c668 R15: 0000000000000001 [ 599.875831][T28162] ? refcount_warn_saturate+0x69/0x110 [ 599.881408][T28162] ? refcount_warn_saturate+0x69/0x110 [ 599.887053][T28162] ref_tracker_free+0x6fc/0x840 [ 599.891916][T28162] ? __pfx_ref_tracker_free+0x10/0x10 [ 599.897302][T28162] ? __pfx_locks_remove_file+0x10/0x10 [ 599.902772][T28162] ? ima_file_free+0x170/0x4e0 [ 599.907652][T28162] ? do_raw_spin_lock+0x12b/0x2f0 [ 599.912674][T28162] ? lock_acquire+0xf0/0x2e0 [ 599.917271][T28162] ? vcc_release+0x54/0x580 [ 599.921780][T28162] mpoad_close+0x1fc/0x3e0 [ 599.926199][T28162] ? __pfx_mpoad_close+0x10/0x10 [ 599.931138][T28162] vcc_release+0x10f/0x580 [ 599.935556][T28162] sock_close+0xc3/0x240 [ 599.939798][T28162] ? __pfx_sock_close+0x10/0x10 [ 599.944645][T28162] __fput+0x44f/0xa70 [ 599.948705][T28162] fput_close_sync+0x11f/0x240 [ 599.953498][T28162] ? __pfx_fput_close_sync+0x10/0x10 [ 599.958903][T28162] __x64_sys_close+0x7e/0x110 [ 599.963614][T28162] do_syscall_64+0x14d/0xf80 [ 599.968215][T28162] ? trace_irq_disable+0x3b/0x150 [ 599.973281][T28162] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 599.979449][T28162] ? clear_bhb_loop+0x40/0x90 [ 599.984569][T28162] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 599.990459][T28162] RIP: 0033:0x7f278819c819 [ 599.994964][T28162] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 600.014753][T28162] RSP: 002b:00007f27863b4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 600.023358][T28162] RAX: ffffffffffffffda RBX: 00007f2788416180 RCX: 00007f278819c819 [ 600.031425][T28162] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 600.039476][T28162] RBP: 00007f2788232c91 R08: 0000000000000000 R09: 0000000000000000 [ 600.047441][T28162] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 600.055505][T28162] R13: 00007f2788416218 R14: 00007f2788416180 R15: 00007fff26b31ac8 [ 600.063491][T28162] [ 600.066900][T28162] Kernel Offset: disabled [ 600.071214][T28162] Rebooting in 86400 seconds..